Crosstalk Solutions

2024-06-06 · open the original ↗

• The Pro Max adds power, capacity and a spectrum-analysis radio. The U7 Pro Max keeps the U7 Pro's form factor and 2.5 GbE port, adds transmit power for coverage, moves to 4x4 MIMO on 5 GHz for more clients, and adds a radio dedicated to real-time spectral analysis. The host has installed one in his attic and worries about heat; both models have fans and are rated to 140°F (60°C).
• The spectrum view shows live and recent channel use per band. On UniFi Network 8.2.93, the U7 Pro Max adds a Spectrum tab covering 2.4, 5 and 6 GHz, with a live waveform plus a waterfall of the past 60 seconds; other access points show only point-in-time SSID, channel and signal. Green means little activity, and yellow or red marks busy spectrum to avoid.
• His own scan showed which channels his neighbours crowd. On 2.4 GHz the waterfall showed heavy use of channels 1 and 11, leaving 6 clearest; on 5 GHz channel 157 was busy and the rest mostly clear; 6 GHz was empty, which he attributes to likely being the only Wi-Fi 7 user in his neighbourhood.
• For now the data only helps you set channels by hand. The host found no sign that the spectral analysis feeds automatic channel selection. Ubiquiti's launch video promises continuous packet capture in a future version, which he says remains to be seen.

2024-06-05 · open the original ↗

• One of AliExpress's cheapest point-to-point bridges comes complete. The host's two-pack cost just under $35 shipped and came with two PoE injectors, Ethernet cables and tie straps; the box claims IP65 weatherproofing, 1–5 km range, 300 Mbps and 2.4/5.8 GHz. Each unit has a master/slave switch, WAN/PoE and LAN ports, and a reset button for one-key pairing.
• Setup took one button press and an IP change. The units appeared to pair on their own at power-up, with full signal bars. Both share a default LAN IP of 192.168.188.253 and the password "admin", so he gave each a static address on his own network; the interface reported confusing addresses, but traffic passed and the internet was reachable.
• Measured throughput was about a third of the box's claim. He got roughly 80 Mbps each way: Speedtest.net gave about 60 down and 43 up; a LAN test to a 10 GbE Mac Mini gave 76/82 with antennas at the ceiling, and 81.7/72.3 when aimed at each other 3–4 feet apart. He explains vendors' 300 Mbps usually sums both directions, so he expected about 150 Mbps at most.
• He judges them good enough for outbuildings, with durability untested. For a barn, gazebo or remote garage running a few cameras or an access point, he says the price is hard to beat. How they hold up over time is unknown; he would trust the IP65 rating mainly under an eave. The video carries a pitch for Rogue Support's bridge design service.

2024-05-30 · open the original ↗

• The U7 Pro Wall is designed to disappear into the wall. With Ubiquiti's flush-mount accessory ($39 extra, with a paintable cover) it protrudes only about half an inch (just over 1 cm); out of the box ($199 MSRP) it mounts on a wall or single-gang box like earlier in-wall models, and a $39 desk mount also exists.
• It drops the switch ports of earlier in-wall models. It is a Wi-Fi 7 AP with 2x2 MIMO on 2.4, 5 and 6 GHz, up to 320 MHz channels, PoE+ power and a single 2.5 GbE port; the host reasons extra ports are of little use flush in a wall. Ubiquiti told him a more traditional U7 in-wall with switch ports is coming, with no ETA.
• The 5.7 Gbps headline overstates real-world speed. Ubiquiti's figure (with 300+ concurrent clients) adds upload and download together; the host expects about 1.8–2 Gbps each way at best. His test, a Wi-Fi 7 Pixel 8 beside the AP at 320 MHz to OpenSpeedTest on a 2.5 GbE port, gave 1,600/2,100 Mbps and then 1,560/1,973 Mbps.
• The host rates it highly, especially for installers. He measured 99°F (37°C) on the back, likes paintable covers over fixed skins (one is now also out for the U7 Pro), and predicts copycat flush-mount APs from TP-Link or others by the end of the year.

2024-05-28 · open the original ↗

• Protect 4 is claimed to be faster and hold more cameras. Ubiquiti says a re-architected NVR core engine speeds the user experience and raises camera capacity by 20%; the host hopes this cures playback stutter and speculates the storage gain comes from optimizing unchanged pixels. He was on UniFi OS 4.0.3 on his UNVR on the day it went GA.
• Footage can now be stored downscaled to save disk. Cameras can record to the NVR at 2K or HD rather than full 4K, which the host suggests for low-detail views such as a hallway or doorway.
• Video archiving exports footage to Google Drive or OneDrive. You choose a date range and cameras and it uploads in the background; in his Google Drive test it created a UniFi folder with subfolders by date.
• New search and tracking tools narrow events to what matters. Camera shortcuts jump to another camera at the same moment, which he demonstrated following himself across three cameras. Area-of-interest filtering limits events to part of the frame, such as a gate, and licence plates can be labelled with a notification when a given plate is detected.
• PTZ patrol and custom doorbell animations were also added. G4 PTZ cameras can pan between set start and end points, and the Doorbell Pro accepts custom JPEG, PNG or GIF images larger than 240×240 pixels. The host upgraded his own UNVR without issue.

2024-05-24 · open the original ↗

• A home router plus travel router gives easy remote VPN access. In this GL.iNet-sponsored video (the host says he used their routers long before the sponsorship), a Flint 2 at home runs a WireGuard server and a Slate AX travel router connects to it as a client. The Flint 2 has two 2.5 GbE ports and four 1 GbE LAN ports, on sale for $127 through June 15.
• Basic home settings deserve attention before the VPN. The host sets the time zone, and recommends Dynamic DNS if your WAN address is dynamic, since a changing IP breaks the VPN server. He also enables AdGuard Home network-wide and widens the default DHCP pool of .100–.249 to .10–.254.
• Enable "remote access to LAN" or VPN clients cannot reach anything. The WireGuard server's default 10.0.0.1/24 tunnel network is fine, but without that setting clients reach only each other. He generates one client profile per device and enables "use DDNS domain" in it if the home IP is dynamic.
• The travel router's LAN must not overlap the home subnet. Both ship on 192.168.8.x, so he moves the Slate AX to 192.168.10.1, also avoiding the remote gateway's 192.168.12.x. Over T-Mobile Home Internet, a CGNAT connection standing in for a hotel, he reached OpenSpeedTest at home at about 40/40 Mbps.
• The Slate AX's side toggle can switch the VPN client on and off. He maps it to the WireGuard client, so in a hotel you connect the router to the wired or Wi-Fi internet and flip the switch. Devices set up once on the travel router then need no reconfiguring at each new hotel.

2024-05-15 · open the original ↗

• The U6 Mesh Pro brings Wi-Fi 6 to an old form factor. It replaces the UAP-AC-Mesh-Pro, first released in 2017, with PoE-powered gigabit Ethernet plus a gigabit pass-through port, IPX6 weatherproofing, 2x2 MIMO and 8 dBi antenna gain on both 2.4 and 5 GHz, wall or pole mounting and 350+ clients, at $199 MSRP in the UI store.

2024-05-14 · open the original ↗

• The host upgraded a full NAS to a larger eight-bay one. He moved from a Synology DS1520+ to a DS1821+; the old unit had 30 TB usable with 28.4 TB used, well past Synology's 20%-free warning. Synology supplied the DS1821+, two 800 GB NVMe cache drives and a dual 10 GbE card ($2,640); he bought eight 12 TB IronWolf drives at $200 each, for $4,240 in all. SHR with two-drive fault tolerance gave just under 63 TB usable.
• Synology's Migration Assistant worked almost perfectly but wipes the new volume. Installed on the destination NAS, it deleted the SHR volume he had built, so he advises leaving the new drives unformatted. Its 3-day-14-hour estimate for 29.1 TB at about 100 MB/s, held to gigabit by the old NAS, proved accurate.
• Some steps remain after migration. He had to repair about three packages and expand the copied volume to the maximum size. Surveillance Station licences need manual reactivation, and the NVMe pair has to be set up as a read-write cache.
• His backup audit found important data failing the 3-2-1 rule. His working drive meets the rule and his Windows image misses it acceptably. But his user folders, mapped to the NAS, rely only on Backblaze if the NAS dies; "RAID is not a backup", so he will add the external USB drive as a second local copy.
• Home Assistant would not start until its RAM was cut. The DS1821+ ships with 4 GB against the old unit's 8 GB, so the 2 GB VM failed; he ran it at 1 GB on its own IoT-network port. He bought two 16 GB Crucial ECC SO-DIMMs at $54 each, against $350 each for Synology-branded ones. The Pi-hole container moved intact but needed its new IP in DHCP.

2024-05-07 · open the original ↗

• The USW Pro Max 16 PoE is a compact switch with Etherlighting. It has 12 gigabit ports, four 2.5 GbE ports, which are the PoE++ ones and suit a U7 Pro, and two 10G SFP+ cages; the other ports are PoE/PoE+ (802.3af/at). A non-PoE version is $279 (US). The PoE model's price is garbled in the captions, though the host expected it to undercut the $799 24-port Pro Max.
• An external power brick is what keeps the chassis small. The supply is rated 54 V, 3.9 A, and there is no power switch. The included rack ears slot into rear notches for wall mounting with a levelled template. An optional rack kit makes it a reversible 1U unit that also holds the brick.
• Setup is standard UniFi, plus Etherlighting controls. It adopted from his UDM Pro Max and was up to date; port LEDs can show speed or VLAN in chosen colours, with breathing mode optional. Filming on May 1, 2024, a day after receiving it, he plans to use it in his 10-gigabit home upgrade in place of the 24-port model, since he does not need the ports.

2024-04-23 · open the original ↗

• This gateway is built for large deployments, not homes. At an MSRP of $599 USD as of recording, it has about twice the capacity of the UDM Pro and UDM SE: 200 or more UniFi devices and 2,000 or more clients, by the host's account.
• Its onboard switch assumes you bring separate PoE switching. The 8-port gigabit switch has no PoE (unlike the UDM SE) and no Etherlighting. The WAN can be port 8, the new 2.5 GbE RJ45 port (up from gigabit) or either 10G SFP+ cage. In the host's reference design, two gateways uplink over 10G to a USW Aggregation feeding USW Pro Max 48 PoE switches, with a USP RPS on both.
• It is rated well above the UDM Pro with IDS/IPS on. It is rated for 10 Gbps wire speed with the firewall only and about 5 Gbps with intrusion detection and prevention, against 3.5 Gbps for the original UDM Pro with IDS/IPS. These are rated figures; the host did not report a throughput test.
• The drive bays only mirror, and failover does not sync footage. Two drives configure themselves as a RAID 1 mirror for UniFi Protect, with no RAID 0 option; the host's two 1 TB surveillance drives synced in about 2 hours. Under high availability, Protect footage is not copied to the secondary, so he advises a second drive set where recording must never lapse, otherwise moving the drives over by hand.
• Shadow Mode high availability brings automatic failover within seconds. Due in UniFi OS 4.0, it links two gateways directly, using port 7 as the heartbeat. Unplugging the primary on an alpha build cost a few dropped pings. Both units must be the same model, which Ubiquiti told him covers all rackmount Dream Machines; he tells installers to budget for two units.

2024-04-12 · open the original ↗

• The existing network hangs on a solar-powered router up the hill. Internet from an ISP in Lone Pine reaches a solar receiving station: a 100 W panel and two batteries powering a MikroTik router, a NanoBeam AC Gen 2 and a 120° LiteAP AC point-to-multipoint radio that feeds the Hoist House and the Gordon House. Coverage was spotty, metal-sided buildings got none, and the ISP's own solar antenna loses power under snow, according to the owner, Brent Underwood.
• The design moves the network core off solar power. A NanoBeam AC Gen 2 there feeds WAN 1 of a Dream Machine SE in a locked 4U enclosure with a 1U UPS. The SE adds dual WAN, so Starlink can serve as primary or backup (too power-hungry for the hilltop solar), plus Protect cameras against theft. The host accepts the double NAT this creates as a trade for getting the core off solar power.
• Every building gets the same simple, sparable kit. A Rocket Prism AC with a 10 dBi omni on the General Store feeds NanoStation AC or NanoBeam AC Gen 2 stations at each building, with U6+ access points behind wood covers inside. The host keeps the Gordon House's NanoStation AC and UAP-AC-M, which runs off its 24 V passive PoE port, and replaces the bunkhouse's mesh-fed UAP-AC-LR. The metal-sided church gets its own station.
• The Hoist House needs its own link, not VLAN trickery. It has no line of sight to town, and routing it through the hilltop solar station would be too hard to troubleshoot at a site this remote. The host proposes a point-to-point link from the bunkhouse, possibly from a pole or the outhouse about 30 ft uphill, reusing the Hoist House's NanoBeam. Contacts on site are still checking the line of sight.
• The favoured mine design skips levels rather than run power down. In Dave's preferred option, a USW Pro 8 PoE at the Hoist House powers Switch Ultras and UK-Ultra access points at the 100–200 ft levels over PoE++. The 400 and 550 ft levels are skipped, and a Game Changer extended-reach Cat6 run carries data to 700 ft. There the pump's AC power runs a switch, an AP and a camera on the pump, with a single Cat6 drop to 900 ft.

2024-04-04 · open the original ↗

• A zoomed-in UniFi Protect live view pans as you tilt the phone. In landscape, after zooming into any camera's live view, turning the phone left, right, up or down shows more of that side of the image. In portrait mode, sliding down enlarges the image and allows the same left-right movement. The host says he learned of it only the day before recording.

2024-03-20 · open the original ↗

• A third-party mount makes a standard Starlink dish usable in motion. The Trio flat mount takes a Gen 2 or Gen 3 dish; the host's Gen 3 standard version with suction cups costs about $475, and adhesive-pad, magnet and bolt options are cheaper. Trio sent the mount free, but the host says he was otherwise uncompensated and has no referral code.
• Dish plus mount undercuts Starlink's own in-motion dish by about $1,500. Starlink's high-performance flat dish, which is the one it sells for in-motion use, is $2,500, against roughly $600 for a standard Gen 3 dish plus the Trio mount.
• The suction-cup mount held through rough roads and a long drive. It took about 10 minutes and an Allen wrench to frame the dish, about 20 pumps per side to fix it to a glass sunroof, and it survived an 8-mile dirt road with an 8,000 ft descent. Power came from the vehicle's rear AC outlet into the Starlink adapter and router.
• Service held unbroken across a 700-mile trip through cellular dead zones. The host reports never losing internet over several days, with car orientation making no apparent difference and speed tests no different from stationary use; one in-motion test with zero cell service measured 278 Mbps down by about 18 Mbps up.

2024-03-05 · open the original ↗

• The host built a free filtering tool for choosing UniFi hardware. The UI Product Selector, at uinotify.net, which the host says he created, filters UniFi access points, switches and gateways by features such as Wi-Fi 6 versus Wi-Fi 7, PoE or PoE+, and built-in UniFi Network. Devices go into a list with a shareable link, and a free account saves lists for later.

2024-03-05 · open the original ↗

• The Cloud Gateway Ultra should be the default single-site gateway. The host rates the UCG-Ultra ($129 US MSRP) right for homes and small businesses on internet up to 1 Gbps, noting most customers he sees run 300–600 Mbps. It has a 2.5 Gbps WAN, four 1 Gbps LAN ports (one usable as a second WAN for failover/load balancing) and onboard UniFi Network for 30+ devices and 300+ clients; he calls it the long-awaited USG replacement.
• Its spec limits are deliberate trade-offs for the price. The host reads the 2.5 Gbps WAN as headroom so a 1 Gbps connection loses nothing to Ethernet overhead; Ubiquiti states full 1 Gbps with IDS/IPS on. Faster LAN ports or multi-gig IDS/IPS would mean more cost, heat and size, which is the $379 Dream Machine Pro (10G SFP+, 3.5 Gbps routing with IDS/IPS). Over 1 Gbps internet, the UCG-Ultra is not for you.
• Each small UniFi gateway fits a different use case. UniFi Express, the priciest of the three, adds a Wi-Fi 6 AP but manages only four more devices and about 60 clients, with no IDS/IPS: for apartments or two-to-three-person offices. The $129 Gateway Lite has no controller or Wi-Fi but full gigabit IDS/IPS: for installers running a hosted or multi-site controller.
• The Dream Router is a step up from Express. A later insert notes the $199 UDR adds a 4x4 Wi-Fi 6 AP, four 1 Gbps LAN ports (two PoE), a 128 GB SSD plus microSD, and runs Protect and Access alongside Network, which the UCG-Ultra and Express cannot. Downsides: rarely in stock, and its 1 Gbps backplane won't reach full gigabit with IDS/IPS.
• The Switch Ultra's PoE budget depends on how it is powered. The $129 USW-Ultra has one PoE+ input and seven PoE+ ports: PoE+ input gives 16 W of output, PoE++ (802.3bt) 42 W, an optional 60 W adapter 52 W and a 210 W adapter 202 W. It has a magnetic mount; one of each Ultra device makes a starter network for about $347 (US pricing), or about $377 with the 60 W adapter.

2024-02-21 · open the original ↗

• Ubiquiti's USW Ultra can run entirely on PoE input. The first switch in the Ultra line has a gigabit PoE++ input port on the back and seven gigabit PoE+ ports on the front, and the PoE budget left for devices depends on how much power comes in. It costs $129 in the US without a power adapter, with a 60 W or 210 W AC adapter offered as an add-on.
• A magnetic mount makes the switch easy to place. The host likes that it holds to metal surfaces without needing a permanent install.

2024-02-21 · open the original ↗

• VLANs layer separate subnets onto the same physical network. Each Ethernet frame carries a VLAN ID (tag), so devices are grouped by tag rather than by the hardware they plug into. The host's example adds guest on VLAN 10, IoT on 20 and VoIP on 30 beside the default LAN on VLAN 1, each a /24 (254 usable addresses), with the VLAN ID matching the third octet by his own convention. He gives three reasons: security, organization and performance.
• The untagged VLAN decides where VLAN-unaware devices end up. A PC or IoT device lands on whatever VLAN a port has untagged, while a device configured for a tag, such as a VoIP phone looking for VLAN 30, joins that VLAN only if the port carries it tagged. He recommends an exposed jack in a public space, like a doctor's waiting room, carry only the guest VLAN untagged, so a plugged-in device gets guest access and a tagged phone gets no address at all.
• Trunk ports match manual tagging but pick up new VLANs automatically. A trunk carries the default LAN untagged and every other VLAN tagged, which works the same as listing them by hand. The difference is that a VLAN added later (say 40 for cameras) must be added to each manually configured port. Trunks are typically used between switches; an access-point port carries the secure LAN untagged plus the guest and IoT VLANs tagged, each mapped to its own SSID.
• UniFi sets up VLANs in two steps from one console. Networks are created under Settings with a manual VLAN ID, then the Port Manager shows each switch port's native and tagged VLANs, and port profiles apply a set to many ports at once. The host enables client isolation on the guest network but not on IoT, because casting, AirPlay and Philips Hue-style hubs need IoT devices to reach each other; the networks still need firewall rules between them, which he does not demonstrate.
• Mixed-vendor gear works but each device must be configured separately. VLANs are a standard, but off-the-shelf consumer routers may offer only a guest network. The host's Synology RT6600ax allows each of its four ports only to be a trunk or carry a single untagged VLAN, and his Aruba 24-port PoE switch had to be told about each VLAN. Plugging in, his PC received 192.168.20.x on the IoT port while the VoIP phone on that same port received a VLAN 30 address.

2024-02-13 · open the original ↗

• Cloudflare Tunnels expose home-lab services even behind CGNAT. The cloudflared connector dials out to Cloudflare and holds the connection, so no firewall ports need opening. Cloudflare then routes each DNS hostname down the tunnel to an internal service, including other devices on the LAN. The host demonstrated it over T-Mobile Home Internet, says he was not paid by Cloudflare or ZimaBoard, and has not tried the alternatives he names, Tailscale and ZeroTier.
• The ZimaBoard is a cheap one-click platform for this. The ZimaBoard 832 costs $199, with an Intel Celeron, 8 GB of RAM, 32 GB onboard storage, two SATA ports, two gigabit Ethernet ports and two USB 3 ports. Its CasaOS app store installs OpenSpeedTest (port 3004) and cloudflared in one click. Where casaos.local does not resolve, the host finds its IP in the DHCP leases or on an attached monitor, and updates it first.
• A tunnel needs a Cloudflare-managed domain and per-service hostnames. The domain is either bought through Cloudflare or pointed at Cloudflare's name servers from another registrar. The tunnel is created under Zero Trust > Networks > Tunnels, and its token command is pasted into cloudflared. Public hostnames then map to http://IP:port, such as the CasaOS dashboard, OpenSpeedTest and the T-Mobile gateway at 192.168.12.1. Until locked down, anyone with the URL can reach them.
• Cloudflare Access locks the hostnames down, but only with a wildcard subdomain. Leaving the application's subdomain blank protects only the root domain, so the host uses an asterisk. His policy uses an emailed one-time PIN for addresses ending in his company domain and adds a US-only country requirement, which he concedes a VPN easily bypasses. IP-range rules and SSO providers (Google, Azure, GitHub, Facebook) are other options.

2024-01-31 · open the original ↗

• Starlink carries about 42 petabytes of traffic a day. The host cites a PCMag article for the figure (42,000 TB, or 42 million GB, daily), and passes on a Reddit user's calculation converting it into an equivalent number of 3.5-inch floppy disks a day.

2024-01-30 · open the original ↗

• Ubiquiti will make two-factor authentication mandatory on every UI account. It takes effect on July 22, 2024. Accounts that have not set up 2FA by then will be defaulted to email codes, which the host calls the least secure and least convenient option.
• The host prefers TOTP or UI Verify over email codes. TOTP is a rotating six-digit code every 30 seconds from an app such as Google Authenticator or Microsoft Authenticator, or from a hardware key like the YubiKey 5 series he uses himself. UI Verify instead pushes an approve-this-login prompt to the phone. Either one covers every UniFi application: Network, Protect, Access, Talk and Connect.
• 2FA is set up under the account's Security settings. Go to account.ui.com, or open any UniFi mobile app and choose Manage UI Account from the profile picture. Under Security, re-enter the password if asked, then use "add new method" under multi-factor authentication. The host hopes Ubiquiti will add FIDO2 or passkeys later.

2024-01-24 · open the original ↗

• The host critiques another channel's install, not one Crosstalk did. The install, shown on Ghost Town Living, brought internet 900 ft down a mine shaft at Cerro Gordo, California. A NanoBeam AC took a feed from an on-property tower into a MikroTik hEX PoE lite, then a pair of Veracity Highwire ethernet-over-coax adapters (up to 200 Mbps, almost $450 together) took it down the shaft. The host offered in December 2020 to wire the town for free in exchange for filming, and repeats the offer.
• The coax adapters were unnecessary once power was run down the shaft. Since mains power already reached the bottom, the host argues a PoE switch could sit down there rather than pushing PoE over coax. A MoCA adapter would carry the network without PoE for about a third of the price and at higher speed, he says.
• He would have used two UniFi switches and armored fiber. With a US-8-150W at each end, armored outdoor fiber could go down the shaft, giving full gigabit, less exposure to lightning than copper, and one management interface for a very remote site. The switches handle both 24 V passive PoE and 802.3af/at. He estimates it at roughly $100–200 more, or more with spares.
• The first attempts failed on a spliced coax and an access point. After the coax was spliced, neither network nor power got through, so 1,000 ft of coax was replaced. A UAP-AC-Mesh-Pro then would not broadcast even on a PoE injector. A non-Pro AC Mesh taken from the hoist house worked at about 50 Mbps. The host would have put the non-Pro unit at the bottom from the start, since wireless mesh cannot pass through rock anyway.
• He would add resilience and reach beyond what was built. A preconfigured spare switch should stay on site, because the hoist house is dusty and very hot or cold, and a replacement could take days or weeks. He suggests Starlink (100–300 Mbps) as a backup WAN. A switch at the 900 level would also let cable run 200 ft up to the 700 level for the water-pump camera, which the build as shown cannot support.

2024-01-17 · open the original ↗

• Gen 3 is excellent where Starlink is the only broadband option. In populated areas the host points to cable or fiber, and argues 5G home internet is faster and cheaper as a backup. He paid $599 for the dish on the Mobile roaming plan and will pause it and keep it in his RV for areas with no LTE. Unpausing bills the whole month. His Gen 1 plan went from $99 unlimited to $120 with a 1 TB cap, and he pays about $30 a month for T-Mobile Home Internet at about 400 Mbps.
• The dish is smaller overall, tougher, and has a detachable cable. It is slightly bigger than Gen 2 but has a manual kickstand instead of a motorized stand, so it takes up less space. It is rated IP67, against IP54 before. It ships with a 50 ft cable that can be swapped for an optional 150 ft one, where Gen 1's cable was fixed.
• Power draw is the host's biggest objection, especially off-grid. Starlink states an average of 75–100 W, against a 75 W maximum for Gen 2. He measured about 10 W for the router alone, a peak of 108 W while booting, and 35–48 W at idle. That is a real drain on RV batteries or solar, compared with about 10 W for his T-Mobile router.
• The router's two built-in Ethernet ports are the big improvement. Gen 2 needed a separate, often out-of-stock Ethernet dongle. The router is also 4x4 MU-MIMO Wi-Fi 6, which the host says mainly helps local transfers because Starlink speeds are about 100–200 Mbps. It can mesh up to three routers, and he believes it works with Gen 2 routers too. It has bypass mode, custom DNS and content filtering, which blocked adult sites when he tested it.
• Setup took about half an hour, and speeds were strong. Plugging it in took about 5 minutes, and connecting and updating took another 20–30. The host praises the app's real-time alignment guide, which corrected a 12° misalignment. He measured 155/9.3 Mbps in the Starlink app and 308/31.2 Mbps on speedtest.net, and 150–300 Mbps down across the house.

2024-01-08 · open the original ↗

• The U7 Pro trades 5 GHz capacity for 6 GHz. It is 2x2 MIMO on all three bands. The U6 Pro is plain Wi-Fi 6 with 4x4 on 5 GHz, so it has about 2 Gbps more 5 GHz throughput. The U7 Pro's ratings are 688 Mbps on 2.4 GHz, 2.8 Gbps on 5 GHz and 5.7 Gbps on 6 GHz, for 300+ clients against the U6 Pro's 350+. The host notes that only the U6 Enterprise and U6 Enterprise In-Wall offered 6E at the time.
• It needs PoE+ and gets wider channels and a 2.5 GbE port. It draws up to 21 W against the U6 Pro's 13 W, and the host measured about 10 W versus 6 W at idle. It also replaces gigabit Ethernet with a 2.5 GbE port. Channel width goes up to 240 MHz on 5 GHz (the U6 Pro tops out at 160 MHz) and 320 MHz on 6 GHz.
• A Wi-Fi 7 phone nearly doubled the other test results. On the U7 Pro at 320 MHz, a Pixel 8 averaged just over 1.4 Gbps down and 1.87 Gbps up. An iPhone 13 Pro Max averaged about 700/812 Mbps at 240 MHz. On the U6 Pro, the Pixel got 673/944 Mbps and the iPhone 622/563 Mbps. Tests ran through a Pro Max switch's 2.5 GbE port to a ZimaBoard with a 10 GbE card running OpenSpeedTest, with one access point on.
• Single-device tests may flatter the U7 Pro on 5 GHz. The host infers that with ten 2x2 Wi-Fi 6 iPhones testing at once, the U6 Pro's 4x4 on 5 GHz gives more lanes and might beat the U7 Pro. That is because much of Wi-Fi 6 and 7's gain is about efficiency with many devices.
• The host sees no rush to upgrade to Wi-Fi 7. The standard was out of draft but awaiting a final vote expected later in the year, and he does not expect that to make these access points obsolete. Buying new after ratification is fine, he says, but existing Wi-Fi 5 or 6 access points have a couple of years left. Without Wi-Fi 7 clients, and with streaming boxes, IoT and printers fine on Wi-Fi 5, little difference would be noticed.

2024-01-05 · open the original ↗

• The host built an all-UniFi rack for 10 Gbps testing. It has a Gateway Pro (UXG-Pro), with two gigabit Ethernet ports and two 10G SFP+ ports. That feeds an Enterprise XG 24 with 24 10 GbE ports and two 25G SFP28 ports, and a USW-Pro-Aggregation with 28 10G SFP+ ports and four 25G SFP28 ports. A Cloud Key Gen2 manages it all. The 25G ports run at 10G for now, until he gets 25G DACs.

2024-01-02 · open the original ↗

• The UK Ultra is a tiny, cheap, mount-anywhere access point. The first product in Ubiquiti's new Ultra line has an MSRP of $109 and is a bit bigger than a deck of cards. It ships with wall, ceiling and pole mounting. It has a built-in antenna plus two hidden RP-SMA connectors for external antennas.
• It is deliberately Wi-Fi 5, with very low power draw. It is 2x2 MIMO on 2.4 and 5 GHz, rated up to 866 Mbps on 5 GHz, with a gigabit PoE port. Its 8 W maximum is the lowest in Ubiquiti's access point lineup, and it is IPX6 weatherproof. Ubiquiti told the host the Ultra line is for low-cost, compact needs that do not require a Wi-Fi 6 4x4 access point.
• The host sees it as a spare and field-deployment tool. His uses are a spare in a technician's bag for client sites, disaster-response Wi-Fi (he volunteers with ITDRC), a portable "network in a box", solar-powered off-grid coverage, and international projects where cost matters more than speed. For home use with 4K streaming and many IoT devices, he would pick the U6 Plus or U6 Pro instead.
• His office tests found ample speed, but external antennas added nothing. A Pixel 8 got 450–550 Mbps both down and up. Antennas taken from an older mesh access point worked on the RP-SMA connectors but did not change bandwidth. He tested only bandwidth, not distance, and assumes a directional mesh antenna would also work for pointing the signal one way.

2023-12-28 · open the original ↗

• The host upgraded to the Beryl AX for its multi-gig WAN. He says the video is not sponsored and he paid for the unit himself. GL.iNet's two Wi-Fi 6 travel routers are similar, but the Slate AX has a 1 Gbps WAN and two 1 Gbps LAN ports, while the Beryl AX has one 1 Gbps LAN and a 2.5 Gbps WAN; about $120 MSRP, often under $100 on sale.
• A travel router's main payoff is convenience for many devices. All of the family's devices are preconfigured for the router's SSID, so the hotel captive portal is cleared once; a campground or in-flight plan limited to three devices sees just one; and casting to a Roku or printing works despite hotel Wi-Fi client isolation.
• Its own LAN adds privacy, at the cost of double NAT. Devices sit behind the router's firewall and use DNS the user chooses (built-in AdGuard Home or filtering DNS) rather than the hotel's. Double NAT is fine for browsing and streaming but may trouble VoIP; one VPN client on the router (OpenVPN to Private Internet Access, or WireGuard home) covers every device and avoids per-device VPN limits.
• Setup pitfalls: separate radio edits, firmware, and AdGuard blocking. The admin page is at 192.168.8.1; the 5 GHz and 2.4 GHz networks must be modified and applied one at a time, and the host advises upgrading firmware first. AdGuard Home blocked the Private Internet Access site until he disabled it. He mapped the side toggle switch to turn the OpenVPN client on and off.
• Wired WAN beats repeating hotel Wi-Fi. The host measured pings jumping between about 65 and 300 ms over the hotel Wi-Fi, then a steady 65–70 ms once he plugged the WAN into the room's Ethernet, which he says rarely has a captive portal. USB tethering to a phone or an LTE modem and multi-WAN failover or load balancing are the fallbacks.

2023-12-13 · open the original ↗

• The Pro Max switches are conventional apart from Etherlighting. There are four models, 24 or 48 ports with or without PoE; at recording the PoE models were shipping first, with non-PoE a few weeks behind. One third of the ports are 2.5 Gbps (8 on 24-port, 16 on 48-port), the rest 1 Gbps, plus 10 Gbps SFP+ cages and PoE+ and PoE++ on the PoE models.
• Colouring ports by native VLAN is the host's killer feature. Every port has full-colour LEDs that, in UniFi Network Early Access 8.0.2, show either link speed (the default) or the port's native VLAN, with customisable colours. He says seeing VLANs at a glance helps troubleshooting and stops devices being patched into the wrong VLAN.
• Locate makes tracing a device's switch port trivial. From the port manager or any UniFi device's settings, locate turns off every port LED except the target, which pulses blue, so a ceiling access point or camera can be traced without following cables. The host calls the switches' AR feature a gimmick by comparison.
• Ubiquiti's Etherlighting patch cables were not yet tested. Ubiquiti released cables it says enhance the brightness and clarity of the port lighting; the host had not obtained any at recording and promises a follow-up.
• The host wants a show-all-ports mode and consistent colours. He asks for a show-VLANs or show-speeds option, also on the switch's 1.3-inch display, lighting all empty ports. He notes the VLAN manager's blue native and green untagged colours could clash with Etherlighting choices, and wants port-manager speed colours synced to Etherlighting.

2023-12-11 · open the original ↗

• A $1,500 Best Buy shelf price was mislabelled, but still outrageous. Twitter users spotted that the price belonged to a TP-Link Deco Wi-Fi 7 whole-home mesh three-pack, not the TP-Link Archer Wi-Fi 7 router on the shelf, which lists at $599 MSRP. The host calls both prices outrageous, noting the Wi-Fi 6E version of the Deco is $269 at Costco.
• Wi-Fi 7 was not yet a certified standard in late 2023. The Wi-Fi Alliance had not certified 802.11be, expected in early 2024, and says products should meanwhile be described as containing Wi-Fi 7 technology. The host would not buy Wi-Fi 7 gear until the standard is formalised, since current devices' compliance is not guaranteed.
• Home users would gain little from Wi-Fi 7 anyway. The host found only a single Intel Wi-Fi 7 M.2 card on Amazon, plus phones such as the Pixel 8; most clients are Wi-Fi 6. He argues the gains are for device density, so a home with a few dozen devices is well served by Wi-Fi 6, and expects wider adoption perhaps in 2025.
• A $600 UniFi network out-covers a single Wi-Fi 7 router. In a 3,400 sq ft (315 m²) floor plan, the host's Design Center model shows a single router missing back rooms. His alternative is a $199 Dream Router plus an optional USW Lite 8 PoE and two U6+ access points, totalling $566; the costs are running Ethernet and a steeper learning curve.
• A $1,500 UniFi build buys flexibility, not needed coverage. Against the mesh three-pack, which he expects to cover about the same, the host specs a Dream Machine SE, three U6 Pros, a U6 In-Wall for the garage and a Flex 10 GbE switch. He stresses he was trying to spend the budget; the $600 setup already gives solid Wi-Fi.

2023-12-06 · open the original ↗

• A travel router's WAN should be wired, not a hotel Wi-Fi repeater. Using his GL.iNet Beryl AX, the host gives three reasons: a more solid connection, no wireless bandwidth taken from client devices, and usually no captive portal on the room's wired network.
• Hotel-room LAN ports can be hard to find. Not every room has one; in his, the only port was on a small device hanging off the back of the television rather than on the wall.

2023-12-01 · open the original ↗

• A cheap PoE splitter lets the UniFi Express run on PoE. The Express has no PoE input, which commenters on the host's first video complained about; a splitter takes PoE Ethernet in and outputs USB-C power plus a separate RJ45 data connection. Micro-USB versions exist for older devices such as early Raspberry Pis.

2023-11-29 · open the original ↗

• UniFi Express is a router, Wi-Fi access point and controller in one. The UX combines a router/firewall, a 2x2 MU-MIMO Wi-Fi 6 access point (22 dBm max transmit power at 2.4 GHz, 25 dBm at 5 GHz), and UniFi OS with UniFi Network on board, so it needs no separate Cloud Key. It is just under 4 in square, has one gigabit WAN and one gigabit LAN port, Bluetooth for app adoption, a non-touch status screen, and draws 10 W max.
• The host rates it better value than the Gateway Lite. MSRP was set at $149 after recording, against $129 for the UXG Lite he reviewed the week before, which has no onboard UniFi Network and no access point. He would rather pay the extra $20.
• It fits small networks only, but it is flexible. Ubiquiti claims up to 60 clients; larger deployments should use a console such as a Dream Machine. Extra Express units can be wired in as access points under any UniFi controller, or meshed wirelessly to give a remote room Wi-Fi plus an Ethernet port. Each unit needs its own power (no PoE), and meshing cuts throughput for devices on the remote unit.
• Ubiquiti says DPI won't cut its gigabit throughput. The host says Ubiquiti confirmed to him that, unlike the Gateway Lite, the Express keeps full gigabit throughput with DPI or content filtering on; he had not yet tested this himself. He rejects calls for 2.5 GbE ports: it targets sub-gigabit connections and people new to UniFi.
• The host found it runs hot but sips power. He measured up to 130°F on the bottom of the unit. Paired with T-Mobile Home Internet, his setup drew just over 14 W, which he suggests suits RVs on a 5G or LTE connection.

2023-11-22 · open the original ↗

• The Gateway Lite is UniFi's long-awaited entry-level USG replacement. The UXG Lite costs $129. Ubiquiti claims 10 times the original USG's routing performance; it has a dual-core ARM Cortex-A53, 1 GB of DDR3L RAM (double the USG's), USB-C power at 15 W, and one gigabit WAN and one gigabit LAN port, against the USG's two LAN ports. The host bought it himself.
• The host says it is for sub-gigabit, simple networks. He dismisses complaints about too few ports, no 2.5 GbE and no PoE: multi-gigabit connections or onboard switching need a different UniFi device, and with VLANs and switches he sees little need for more firewall ports.
• It is not a console and needs a separate controller. He first said it needed UniFi Network 8.0.6 or higher, then found that wrong: his Cloud Key Gen 2 on an older 7.x release still adopted it after four rounds of updates. By default Teleport and DPI are on, IDS/IPS are off; he thinks Teleport should be opt-in. It is fanless and silent and ran at 125–130°F.
• A minimal Gateway Lite setup costs over twice a Dream Router. Gateway Lite plus a Lite 8 PoE switch, a Cloud Key Gen 2 and a U6 Lite access point comes to just over $400, against a Dream Router at less than half that. What the separate setup buys is placement flexibility and not putting all your eggs in one basket; he does not know whether it performs better.
• The host favours it for installers with a hosted controller. With one central controller (Ubiquiti's official hosting or a service such as HostiFi), he would standardize small-business customers on Gateway Lite setups. That leaves one controller to update and back up, costs much less than a Dream Machine Pro per site, and lets spares be kept on hand.

2023-11-16 · open the original ↗

• The new Radio Manager allows bulk access-point radio changes. UniFi Network 8.0.7, in Early Access at recording and subject to change, adds a left-menu page for filtering access points by band or MIMO class and setting values such as transmit power across many at once. The host is on the fence: he wants control in UniFi but fears MikroTik-style overload for new users.
• A Ports page summarizes every switch port network-wide. It shows each in-use port's connected device, PoE type and link speed, with filters. An Insights view breaks out per-port usage, packets and PoE; on his Pro 24 PoE switch it showed port 2 at 183 MB against port 4 at 1.7 MB, useful for finding where traffic flows.
• The host's favourite change is the new VLAN viewer. It stacks VLANs against switch ports and colour-codes native (untagged) and allowed tagged VLANs per port, with a simple native-VLAN and allow/block setting. He thinks it will help VLAN newcomers, but warns the blue, grey and green coding may be hard for colourblind users.
• UniFi Network now has a WireGuard VPN client. Before this the only VPN client was OpenVPN. A WireGuard config, such as from PiVPN or a provider like NordVPN or Private Internet Access, imports and sets itself up. Routing rules then send chosen traffic through it; his demo routes reddit.com over the tunnel.
• Smaller additions include SD-WAN site stats and richer client logs. Site Magic SD-WAN sites now show device and wired/wireless client counts per site; he has none set up to demonstrate. The system log's client tab now records connection time, data usage, SSID and access point, which he expects to help troubleshooting.

2023-11-09 · open the original ↗

• Venmo transactions are public by default and should be made private. Anyone you have transacted with can view your other transactions. The fix is Me icon → gear → Privacy → default to Private, which covers future transactions only; also open Past Transactions and choose "Change All to Private".

2023-10-21 · open the original ↗

• A ZimaBoard takes 10 Gbps networking with almost no setup. The host plugged a 10-gig network card into the ZimaBoard's PCIe slot, where it was detected and configured automatically, linked it through a UniFi Switch Flex XG to his Windows PC and core switch, and measured more than 5 Gbps with the one-click OpenSpeedTest app from the CasaOS app store; the whole job took under 15 minutes.
• The 10-gig card runs hot in the ZimaBoard. The host measured the network card at up to 112°F during the test.

2023-10-20 · open the original ↗

• The host recommends the Gen 3 router only for some users. New Starlink customers should get it outright; existing users already running a Gen 2 with the Ethernet adapter into a third-party router, and RV, camping or temporary-event users, gain nothing; heavy home users with many devices, and those meshing several Starlink routers, may see better speed and range.
• Gen 3 is sold separately, with a per-customer purchase cap. It costs $199 and Starlink allows up to three; Starlink invited customers into a "limited launch" of the router by email on Tuesday, October 17th; one unit plugs into the dish and the other two serve as wired or wireless mesh repeaters. The host does not know whether Starlink is bundling Gen 3 with dishes yet, and assumes it will become standard.
• Starlink's wireless specs are a substantial step up from Gen 2. Per Starlink, it moves from Wi-Fi 5 to Wi-Fi 6, from 3x3 to 4x4 multi-user MIMO, and from 128 to 235 supported devices; the claimed range gain is hard to measure, though the host finds it plausible from the larger antenna. The environmental rating rises from IP54 to IP56, still indoor-only.
• Two built-in Ethernet ports are the host's biggest Gen 3 advantage. Gen 2 had no port and needed a separately sold accessory that was often out of stock or delayed; Gen 3's ports take wired devices or hand Starlink to a third-party router such as UniFi or Omada, ditching Starlink's Wi-Fi.
• The host advises hardwiring additional Gen 3 routers rather than meshing wirelessly. The two ports let two more routers be wired back (strictly access points, not mesh) up to about 100 m (328 ft) on Cat5e or Cat6. Gen 2 routers can mesh to a Gen 3 but stay Wi-Fi 5; Starlink's placement notes warn that more than three nodes can degrade mesh performance, and the host would move to more robust third-party access points beyond that.

2023-10-16 · open the original ↗

• A remote RV park delivered good Wi-Fi from point-to-point-fed Aruba access points. At the Crater Lake RV park in Oregon, the service came from an omnidirectional antenna on a 30 ft pole, distributed to Aruba access points on light posts and purpose-built posts, many fed by Ubiquiti point-to-point links such as a NanoBeam with a switch in a box. The host measured above 100 Mbps all weekend, sometimes up to 300 Mbps up and down.

2023-10-12 · open the original ↗

• Proactive monitoring caught the intrusion; snapshots restored it without downtime. In mid-August 2023, Zabbix and Grafana rules flagged the FreePBX firewall being disabled on seven Crosstalk-hosted systems, then changed authorized_keys files; a cron job had added an admin user and keys, called a server in France, and given attackers root, while calls kept working. ClearlyIP blocked PHP execution through the phone apps port within a day or two, and servers were restored from pre-attack snapshots after hours, with customers emailed throughout.
• The likely initial vector was a DEF CON-disclosed FreePBX zero-day. On August 12th 2023, under a week before the hacks, a researcher with the handle "good pseudonym" showed at DEF CON 31 that a phone API could be entered with a registered phone's MAC address, the hard-coded password "login" and a spoofed Digium/Sangoma user-agent, then used for plain command injection into a PHP exec call. The host infers the link from the timing.
• The host argues Sangoma's patches and advice fell short. The researcher says he reported in early May, got one reply and then silence, and demonstrated his exploit still working against Sangoma's patched API. Sangoma's blog cites a September 5th 2023 fix and urges closing phone apps and enabling the responsive firewall; the host's servers were IP-locked or firewalled yet still hacked. A September 28th re-patch was rated "minor", and version 14 and earlier get no fixes.
• Sangoma apparently removed its bug bounty page rather than pay out. Sangoma's blog thanked Systems Research Group, which the host assumes is the same researcher, but as far as he knows paid no bounty; archive.org last captured the page in March, and a Ward Mundy post dated September 17th 2023 still linked it, suggesting removal before Sangoma's September 20th blog post.
• The host thinks FreePBX is stagnating and Sangoma should give it up. He notes no significant update since version 15 in 2019, an aging CentOS 7 base with old PHP and OpenVPN, and a vague FreePBX 17 on Debian; with almost 80% of Sangoma revenue from recurring services, he sees no incentive to compete with its paid products, and urges Sangoma to sell or donate the project, offering to take it over himself.

2023-09-26 · open the original ↗

• Any OpenVPN-capable proxy service can run inside UniFi Network. UniFi's VPN client tab takes the provider's .ovpn file plus account username and password, covering devices like a Roku, game console or smart TV that can't run VPN apps. The host demonstrates with Private Internet Access, which he says he has used for about five years, and links it through his affiliate link (quoted at $2.03 a month plus four months free); the video is separately sponsored by ZimaBoard.
• Generate the PIA config near you; streaming servers remain untested. In PIA's OpenVPN configuration generator he picked OpenVPN 2.4 or newer and the Linux platform (the only one he tested) and chose US West for latency. Hulu warned him off from the standard US West IP; PIA's "streaming optimized" US West and US East servers are meant for that case, but he says he has not tested them.
• Traffic routes send chosen devices or domains through the tunnel. A device rule routes all traffic from one or several selected devices (his iPhone) over the VPN client interface, which he confirmed by matching the public IP on whatismyip.com to the tunnel. A domain rule (privateinternetaccess.com, netflix.com) applies to all or selected devices, and other sites keep the T-Mobile Home Internet WAN IP.
• A dedicated VLAN and SSID makes every connected device private. He creates a network at VLAN 53 with its subnet's third octet matching the VLAN ID, a DHCP pool from .10 to .254 leaving .2–.9 for static devices, an SSID on top, and a route sending all its traffic through PIA. Routing and firewall changes can take a minute or two to take effect.
• The OpenVPN link is fickle, and new networks are open by default. "Test and save" never stops spinning; he waits a minute or two, leaves the page and returns to see the connection up, and re-applies the client when it drops. Every UniFi network can reach every other one, so he advises block-by-default firewall rules, covered in his previous VPN video rather than here.

2023-09-12 · open the original ↗

• Teleport is one-click remote access, but only for phones and tablets. It reaches internal services (Pi-hole, Home Assistant, a Synology NAS) and routes public-Wi-Fi browsing through the home connection without a proxy-service fee. Admins see their sites in the WiFiman app via Ubiquiti single sign-on; other users need a per-user link that expires in 24 hours if not accepted, and Windows PCs cannot use it.
• The VPN server suits other devices; the host recommends WireGuard. He calls L2TP older and less secure, and says WireGuard has replaced OpenVPN as lighter and faster yet as secure. Manual advanced settings allow a custom subnet and DNS (Active Directory, Pi-hole); create one client per device and send the config file, since he found the QR code hard to scan even on an iPhone 13. Double-NAT setups may need firewall ports opened.
• Teleport and VPN-server clients see every internal network by default. He calls this backwards: build an RFC 1918 IP group (192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8), add a LAN In drop rule from it to itself above the predefined rules, then pairs of accept rules above that for each allowed path. VPN subnets (Teleport 192.168.3.0/24, WireGuard 192.168.4.0/24) need IP groups because they are not listed as networks; his pings confirmed the result.
• VPN client makes the UniFi gateway a client of an outside server. Traffic routes or a separate VLAN can send chosen traffic to an employer's OpenVPN server or to a proxy service. The host says Private Internet Access, which he uses personally and links through the description, "100%" works with it, and defers the full setup to a later video.
• Use site-to-site VPN across vendors, Site Magic between UniFi gateways. Site-to-site joins mixed hardware with a pre-shared key (he once linked an EdgeRouter to a Cisco RV345P), and he points readers to Crosstalk's own Rogue Support service for it. Site Magic, UniFi's SD-WAN, needs UniFi OS 3.1+ gateway consoles or a UXG Pro with a Cloud Key on Network 7.4+, excludes the old USG, needs one public WAN IP and one owning account, and caps groups at five sites pending UniFi OS 3.2.

2023-09-08 · open the original ↗

• Every iPhone user should install iOS 16.6.1 immediately. The host reports that Citizen Lab found a zero-click vulnerability being used to deliver NSO Group's Pegasus spyware: a malicious image sent by iMessage infects the phone without being opened, exposing location, texts, camera, microphone and keylogged passwords. iOS 16.6.1 patches it.

2023-08-30 · open the original ↗

• The host calls choosing RingCentral a bad business decision. He says up front that VoIP is Crosstalk's core business and RingCentral a direct competitor, so he stands to profit from the criticism. He rests the case on one client, a roughly 65-employee engineering firm that he calls "Mom and Pop Engineering" and that signed with RingCentral in 2020 while keeping its own Polycom phones.
• The client's bill was far too high for its size. It paid over $2,200 a month in service alone, owning its phones, for 65 users, 92 DIDs and two meeting rooms. The two rooms cost $363 a month, while the host puts real Zoom Rooms at $499 per room per year, about $66 a month for two.
• RingCentral would not let the shrunken client cut licences. The firm fell from 65 to 24 employees during COVID and used about 1,000 minutes a month, but its contract blocked downsizing. By the host's own Crosstalk Cloud PBX calculator, those minutes and 92 DIDs cost about $100 a month, or about $300 with two Zoom Rooms, before taxes of roughly 15–20%.
• The host calls RingCentral's add-on fees padding. The bill carried about $256 a month in state, local, USF and E911 taxes, plus another $256 for a "compliance and administrative cost recovery fee". He reads RingCentral's own explanation of that fee (regulatory compliance, number management, data centres, patents) as costs that belong in the 52 unlimited licences. Even with taxes and fees removed, the bill stays above $1,750 a month, more than five times his alternative.
• A surprise three-year term trapped the client after it switched. Crosstalk quoted about $1,350 up front for migration, configuration, training and 30 days of support, which the host puts at a two-month payback and savings of over $2,000 a month. RingCentral then said the contract ran three years, leaving more than $27,000 still owed. Crosstalk, which says it is month-to-month only, agreed to delay billing a year. The host's prescription is to own your phones and numbers and pay only for the minutes you use.

2023-08-22 · open the original ↗

• A software firewall and MikroTik core handled the event's edge comfortably. Whale LAN at LTX 2023 had a 5 Gbps fiber connection, terminated on a 1U Supermicro server running OPNsense with a 4-port 10 Gb NIC. That server linked by 10 Gb DAC to a MikroTik CCR2216-1G-12XS-2XQ core with a 16-core CPU, a Marvell Prestera switch chip for layer-3 hardware offload, two 100 Gb QSFP28 ports and twelve 25 Gb SFP28 ports.
• A huge local game cache kept internet use low. The LANcache server (dual 32-core AMD Genoa, 1.5 TB DDR5, six 15 TB Kioxia CM7 Gen 5 NVMe drives in an LVM stripe with XFS, 84 TB) hung off the core on two 100 Gb links aggregated to 200 Gbps. It was preloaded with 32 TB, about 25% of it Windows updates, and took on 1.5 TB more over the two days. Internet peaked at about 2.1 Gbps, which Jake Tivy attributes to speed tests and credits the cache for.
• UniFi gear, Ubiquiti being the event sponsor, gave every seat multi-gigabit access. Two UniFi Switch Pro Aggregation units each got 100 Gb from the core over four aggregated 25 Gb links, the far one over mini-armored indoor single-mode plenum fiber from infinitecables.com. Each table had a dual 10 Gb aggregated Cat6 uplink to an Enterprise 48 PoE or XG 24 switch, so every attendee had at least 2.5 Gb and some tables had 10 Gb.
• Tivy measured the cache well past 200 Gbps. He used the LANcache prefill tool's benchmark mode: locally it pulled 300–400 Gbps. Across the network, two Proxmox VMs, one per 100 Gb link because LACP will not spread a single client over both, reached 200 Gbps, and a third server took it to 300. He dropped ZFS after hitting a ceiling around 80 Gbps on what he calls a highly random workload.
• Copper-to-SFP transceivers were the only trouble; next year runs fiber to tables. Tivy says the networking had essentially no problems, apart from inconsistent RJ45-to-SFP transceivers on longer Cat6 runs. He cites LANFest Colorado running the same unarmored fiber to its tables for five or six years. Because the LAN sat in front of the main loading door, a small team tore it down and loaded pallets in about two hours after the 6 pm close.

2023-08-15 · open the original ↗

• The SunFounder PiPower 2 is a cheap pass-through Pi UPS. It costs $25.99 and works with Raspberry Pi 3 and 4 boards, the Zero and Zero 2, and other single-board computers that run on 5 V 3 A power. It takes USB-C in and gives USB-C or micro-USB out from a 7.4 V 2000 mAh lithium-ion battery, which the host says runs a Pi for about three to four hours.
• Its extras beat a DIY battery, but the host couldn't get graceful shutdown working. It has a power switch, charging and power LEDs, four battery-level LEDs at 25% each, and I/O pins for battery voltage, USB-power detection and a low-battery signal. He soldered the low-battery pin to a GPIO pin and tried both a config.txt line and a Python service, but neither left any log output, so he does not know whether either worked.
• The host argues most people don't need one. His reasoning is that anything critical enough to need high uptime probably shouldn't run on a Pi, and enthusiasts can plug the Pi into a UPS they already own. He sees a use in portable setups such as boats and RVs (the main answer when he asked on Twitter), on unstable power, in protecting SD cards from hard power loss, and for Home Assistant, Pi-hole or VPN Pis without a larger UPS. At $26 he would buy rather than build one, and notes it was sold out at SunFounder at the time.

2023-08-11 · open the original ↗

• The host deployed with ITDRC to bring Wi-Fi to a fire camp. The camp is the 36-acre Bedrock Fire base camp in Oregon, where first responders sleep, eat and shower between shifts. Gigabit fiber was run to the camp's IT tent a day or two after it opened, at what he calls a significant cost, and he calls having it at so remote a site a lifesaver.
• Point-to-point links and Meraki APs spread that fiber across the site. From the IT tent, one point-to-point goes to a trailer with a LiteBeam AC on the receiving end and another goes to the dining tent, which has its own indoor access point. Two directional Cisco Meraki MR86 access points on the trailer cover the security gate and the sleeping field and showers. The host got about 30 Mbps on the free public Wi-Fi from the far side of the field.

2023-07-28 · open the original ↗

• Passkeys are FIDO2 security repackaged for ordinary consumers. The host explains them as the consumer version of the FIDO2 and WebAuthn standards (originally "discoverable WebAuthn FIDO credentials", renamed by Apple). The device holds a private key and the site holds only the public key. Instead of a YubiKey, the vault becomes the Apple iCloud Keychain or the Google/Android ecosystem, unlocked with Face ID or Touch ID.
• Even the weakest passkey beats the strongest TOTP or SMS setup. The host's reasoning: there is nothing to phish, and a server breach leaks only public keys, because the challenge is answered locally on the device. He contrasts this with the LastPass breach, where stolen vaults protected by weak master passwords can be brute-forced, bypassing two-factor entirely. He cites an estimate that weak passwords cause 81% of hacking-related breaches.
• Synced passkeys trade some security for sharing; hardware-bound ones don't. Apple lets users share passkeys by AirDrop, and iOS 17 adds family groups for sharing passwords and passkeys. The host concedes this makes synced passkeys less secure than hardware-bound keys like YubiKeys, but still more secure than any other method in common use.
• Adoption is still early, in consumer and enterprise use alike. In his Best Buy demo (iPhone, iPad, and a PC via QR code), you still need a password to sign up, and it can't be removed once a passkey exists. Google Workspace opened a passkey beta the month before recording. Enterprise questions (personal devices, credential sharing, compliance) remain unresolved, so he suggests firms use hardware-bound FIDO2 keys meanwhile. passkeys.directory, run by 1Password, lists which sites support them.
• The host keeps YubiKeys for sensitive accounts, synced passkeys elsewhere. He puts financial, email, password-manager and work accounts on hardware-bound YubiKeys, and lower-stakes logins (Best Buy, eBay, Adobe) on synced passkeys. Yubico sponsored the video and gave a $5 discount code, and the host says he has used YubiKeys for over three years. For those who distrust Apple and Google, 1Password, Bitwarden and Dashlane have announced passkey-manager support.

2023-07-11 · open the original ↗

• Raising 5 GHz channel width roughly doubles per-device Wi-Fi speed. UniFi and many other brands default to 40 MHz, which the host says gives about 250–400 Mbps per device; 80 MHz gives about 800–900 Mbps. In UniFi Network it is under Settings > Wi-Fi globally, or per access point under Devices > Settings. Other standalone APs may hide it behind an advanced mode.
• 80 MHz, not 160 MHz, suits most access points. Most APs have a 1 Gbps network port, so 900 Mbps at 80 MHz already maxes them out. The host says 160 MHz only makes sense for an AP with a 2.5 Gbps port on a 2.5 or 10 Gbps switch port. Wider channels also interfere with neighbours: fine for a rural house, but go conservative in a city apartment. He says that is why vendors default to 40 MHz.
• Test Wi-Fi speed against a local server, not the internet. The host recommends OpenSpeedTest (openspeedtest.com), a lightweight tool that runs in Docker or on an nginx server or VM. Testing on the LAN keeps the internet connection from being the bottleneck.

2023-07-05 · open the original ↗

• Hardwire everything possible and home-run switches to the core. The host says a wired link always beats Wi-Fi (a smart TV streaming 4K, for example) and frees up wireless airtime. Buy more ports than you think you need: a 16-port switch rather than 8. Bring each switch back to the core switch instead of daisy-chaining, since every extra hop adds a point of failure and can cram many devices through one gigabit port.
• Uplink ports at 2.5 or 10 Gbps keep switch links from bottlenecking. Gigabit is the standard per-port speed, and the older standard was 10/100. Larger switches often have uplinks in SFP cages that take fiber transceivers, Ethernet transceivers or DAC (direct attach copper) cables. The host says most home users won't need SFP or fiber.
• Managed switches add per-port control that most homes barely need. Unmanaged switches are plug-and-play. Managed ones, through a GUI or an ecosystem like UniFi or TP-Link Omada, can toggle PoE per port, force link speed, and do port mirroring and link aggregation (four 1 Gbps ports acting as one 4 Gbps port). The host says home users will never need layer 3 switching, and most simple home networks don't need VLANs, though VLANs help in isolating IoT devices.
• Standard PoE senses the device; passive PoE can fry it. Switch ports are rated PoE, PoE+ or PoE++ in rising power, and most PoE switches now provide PoE+ (802.3at). Some point-to-point gear uses 24 V or 48 V passive PoE, which sends power regardless of what is attached. On home switches that is rare and usually has to be enabled per port.
• Buy Cat6, cheap, from Amazon or Monoprice. The host says Cat5e is rated to 1 Gbps and Cat6 to 10 Gbps over a shorter distance, and the two now cost almost the same; avoid hardware and big-box stores. He suggests cable testers from about $10, or around $50 for a Klein Tools model. For switches he suggests Netgear or TP-Link 5-port unmanaged gigabit models under $20, the UniFi Flex Mini at about $29, UniFi Lite switches at 8 or 16 ports, and managed 8-port PoE switches at $60–120 (a Netgear PoE+ model at about $60).

2023-06-27 · open the original ↗

• Cat6 can be terminated in under a minute with the right tools. The host's sequence: trim clean ends, strip the jacket, cut the rip cord and the wire separator, untwist and straighten the four pairs (an untwist tool helps), line them up in order and stretch them tight, trim evenly, slide them in so the jacket sits inside the connector, crimp, repeat on the other end, then test.

2023-06-23 · open the original ↗

• Combo routers trade flexibility for easy setup. The host's three router types are standalone (like the Ubiquiti EdgeRouter X), all-in-one combo units, which are the commonest and easiest but leave poor coverage hard to fix, and managed ecosystems like UniFi or TP-Link Omada. Managed gear gives one interface for everything, at the cost of standardizing on one vendor.
• Match router ports to the connection; a cheap router suffices otherwise. He says a 1 Gbps WAN port covers typical 100–300 Mbps service, but gigabit-plus fiber needs at least 2.5 Gbps. Dual WAN allows failover, for example to T-Mobile 5G home internet at about $25 a month for existing customers. He finds a $99–139 Netgear rarely distinguishable from a $350 "gaming" router.
• NAT and firewall rules are separate jobs. In the host's analogy, NAT is the apartment receptionist that swaps each device's private IP for the one public WAN IP and routes replies back, while the firewall is the security guard checking traffic against rules; off-the-shelf routers do both by default.
• Subnet, gateway, DNS and DHCP are the core setup concepts. A 255.255.255.0 mask, or /24 in CIDR, gives 254 usable addresses; 192.168.x.x is private and the commonest default; the gateway is usually .1; and DHCP hands out leased addresses from a pool. The host swaps ISP DNS for public servers such as Cloudflare 1.1.1.1 and Quad9 9.9.9.9 for privacy and filtering.
• The Netgear's simplicity hides defaults you cannot change. On the Netgear it set up, clients still got the router itself as DNS server instead of 1.1.1.1/9.9.9.9, with no visible setting to change it. The roughly $59 EdgeRouter X needed a static laptop IP, assigning eth0 as WAN, and editing an odd default DHCP range to .2–.254. On both he changed default passwords and updated firmware first.

2023-06-16 · open the original ↗

• The host found the Alta AP6 Pro on par with Ubiquiti's U6 Pro. In his LAN tests (OpenSpeedTest on a Synology NAS, one AP broadcasting, both at 80 MHz), speeds matched on Windows PCs; on Apple devices upload was slower on both, but much slower on Ubiquiti. NetSpot heat maps showed near-identical range, Alta slightly ahead. Alta supplied the units free, without other compensation or review approval.
• Alta management is cloud-only for now. Alta's CTO, in a statement the host obtained, says an on-premises controller is on the roadmap with no ETA. The host does not mind the cloud but expects it to be a non-starter for many viewers, and notes Alta then sold only APs, with switches coming, so there is no single pane of glass.
• The dashboard's real-time views and multi-password SSIDs impress him. He praises per-AP, per-device and per-application live traffic, very fast adoption, updates and reboots, and one SSID with several passwords each mapping clients to a network type, VLAN or throttle. App filters apply to the whole SSID, though, and the "always on" broadcast-without-internet option is off by default, which he thinks is wrong.
• A gigabit uplink on a 5.8 Gbps AP is his main hardware complaint. His tests touched about 900 Mbps at 80 MHz, so 160 MHz would bottleneck on the gigabit NIC; he also found the bracket awkward and the heat sink up to 128°F (53°C), close to a U6 In-Wall's 125°F. List prices: AP6 Pro $179, about $20 above the U6 Pro.
• The host is replacing his home Ubiquiti APs with Alta. He calls the software beta: the mobile app breaks with enlarged fonts, and a manual 5 GHz channel killed 5 GHz entirely until set back to auto. He judges good hardware the better half to have right, says it is too early to call it a "Ubiquiti killer", and asks installers to test it themselves.

2023-06-13 · open the original ↗

• A campground runs a large all-Ubiquiti point-to-multipoint network. The host traces it from the main office, which has a pair of PrismStation ACs with 60-degree antennas plus a UniFi Mesh Pro AP, out to cabins with point-to-point links, poles carrying what looked like Flex HD and Mesh AC APs with directional antennas, and a rare IsoStation AC.
• The standout pole carries a full stack of gear. The host spotted a Mesh Pro AP, a NanoStation, three bullet cameras, a Nano switch and a large dish antenna that appeared to point at towers across the river; these identifications are his from sight, several hedged as "what looked like".

2023-06-08 · open the original ↗

• Internet speed is bandwidth in megabits, mostly sold as download. The host separates Mbps (rate, cars on a highway) from MB (size, cars in a parking lot); ISPs advertise download speed, upload is usually far lower because most data flows inward (his own line is 600 Mbps down, 40 Mbps up), and symmetrical connections match the two.
• The host recommends fiber wherever it is available. By his figures ADSL runs about 1–20 Mbps down and 1 Mbps up depending on distance to the exchange; cable typically 60–400 Mbps, up to 1 Gbps at a steep price; fiber 100 Mbps to multiple Gbps, usually symmetrical, but mostly in denser areas, whereas cable is available almost everywhere.
• Wireless options trade stability for reach. He puts 5G home internet at about $50 a month or less bundled with a phone plan, capable of hundreds of Mbps but only as good as the signal at the modem (place it in a window); legacy geostationary satellite like HughesNet at 12–100 Mbps down, fit only for light use; Starlink at 50–300 Mbps down, 20–40 Mbps up; and WISPs as sometimes faster than big ISPs.
• Keep the ISP modem simple and put it in bridge mode. ISP combo units are convenient for small, wireless-only homes but low quality, hard to extend and often leased at $10–20 a month; bridge mode lets your own router hold the public WAN IP, which is usually dynamic unless you pay monthly for a static one, with dynamic DNS as the workaround.
• Troubleshoot by pinging and by removing hops one at a time. If ping 1.1.1.1 (Cloudflare) answers, the internet is reachable; if a site answers by IP but not by name, the fault is DNS. For slow speedtest.net results, retest wired to the switch, then directly at the router or modem, and call the ISP only if it is still slow there.

2023-06-06 · open the original ↗

• A well-designed home network is one you never think about. The host frames the goals as reliability (like plumbing, noticed only when it fails), getting the full speed you pay for, security against outside threats, and future-proofing for devices not yet imagined; slow sites, Wi-Fi dead zones and buffering are his signs of a network needing work.
• IP addresses work like postal addresses for data. The host's analogy: every device has a unique IP address, and data is delivered to a destination IP the way a letter reaches a street address, whether the destination is in the next room or a website server across the world.
• Every home network has four core components. They are the modem (the ISP's hand-off between home network and provider), the router/firewall, network switches (more wired ports) and wireless access points (Wi-Fi clients); the host stresses that consumer gear often combines two or more in one box, so knowing each role separately is the key to understanding any device.
• A router moves traffic between networks; a firewall filters it. The host likens the router to a highway interchange between the private LAN and the public WAN, and the firewall to a border checkpoint; home routers ship with default firewall rules blocking unsolicited inbound traffic, which is why the terms get used interchangeably.
• Buy Cat6 or better Ethernet cable. The host says Cat6 with RJ45 ends is now the most common type, the category is printed on the jacket, and it is rated for gigabit or higher up to a maximum run of 100 m (328 ft).

2023-06-05 · open the original ↗

• The greenhouse runs off a shed solar system. A 400 W panel feeds an MPPT charge controller powering a 2200 W inverter and a 12 V fuse box; a 3 A fuse feeds a 12 V DC to 5 V micro-USB converter that powers a D1 mini ESP8266 Wi-Fi board with a soldered-on BME280 temperature and humidity sensor.
• Home Assistant reads the sensor and drives two automations. Through the ESPHome integration the D1 mini's readings are graphed, and automations switch on a seedling heat mat when it is too cold and a fan when it is too hot, both via TP-Link Kasa smart switches.

2023-05-31 · open the original ↗

• The Mesh++ S618 packs solar power, backhaul and Wi-Fi into one case. The IP67 pole-mountable node holds an MPPT charge controller and a 1.2 kWh battery that Mesh++ says runs it five to ten days without input; it takes a 60 W USB-C supply or a 75 W panel, upgradable to 100 W. In the host's test, with the panel badly placed on the ground, the battery fell only about 4–5% each night.
• It takes internet three ways, and the tested speeds track the source. Through a NanoStation M5 bridge powered by the S618's 24 V passive PoE output the host got 92.7/40.8 Mbps, capped by the M5's 100 Mbps NIC and his own 40 Mbps upload. A T-Mobile Home Internet gateway plugged in directly gave 105/10 Mbps; an internal LTE/5G option has two SIM slots for redundancy.
• Only one node needs internet; the rest mesh automatically. Extra nodes are added over Bluetooth in the app and fail over if a neighbour drops; the spec is up to 400 ft (122 m) between nodes, or about 1,000 ft (300 m) line of sight with antennas on the N-type connectors. A second node about 75 ft from the LTE node gave the host 32/23 Mbps; radios are 2x2 on 2.4 and 5 GHz, with an optional 4x4 Wi-Fi 6E upgrade.
• The host wants better hardware details and an advanced mode. The add-on USB Ethernet board comes apart easily, its directional USB-C cable relies on a blue orientation dot that wore off outdoors, and the LEDs sit off-centre in the window. The deliberately simple app and cloud dashboard hide node IP addresses and give no switch to disable the 24 V passive PoE output, which could fry a device that cannot handle it.
• He judges it a success for reach, not speed. He calls it a polished first product from a startup, built for remote schools, parks and campgrounds rather than streaming. He says it would have saved enormous effort on the 2018 job where Crosstalk built solar-powered Wi-Fi along two miles of remote Indonesian shoreline for the TV show Castaways. The video makes no sponsorship disclosure.

2023-05-30 · open the original ↗

• This short is a blooper reel with no technical content. The 71-word caption track is the host unboxing gear and tossing the boxes off camera, ending as he pulls out what he calls "the RPS"; no product, claim or advice is made.

2023-05-12 · open the original ↗

• A UniFi Switch Aggregation fits inside a Dream Machine Pro. The switch's eight 10 Gb SFP+ cages almost exactly match the UDM Pro's drive-bay footprint. The host and a mechanical-engineer friend spliced both off one power supply and removed the drive cage, mounting the switch board on a 3D-printed bracket. They also cut down a heatsink and laser-cut the front bezel; the STL files are linked, and the warranty is almost certainly void.
• The cost is storage: only a 2.5-inch drive, now unserviceable. The UniFi Protect drive sits on a bracket above the UDM Pro's board on a SATA extension, so changing it means unracking and opening the case; the host fitted a 1 TB SSD and says up to 5 TB fits. He adds that anyone needing more than 5 TB, or more than a few cameras, should move to a UNVR anyway.
• UniFi adopted the hybrid as normal, but AR broke. The UDM Pro detected the internal switch as a separately connected switch at full 10 Gbps. The AR feature misplaced the switch's ports and would not lock onto the UDM Pro screen at all. Both units share the same 1.3-inch display board, mounted side by side, and the host warns these screens chip easily on removal even with a heat gun.
• His real wish is a 2U UniFi all-in-one. He wants a 2U UniFi firewall with a 16-port PoE switch, 10 Gb and 2.5 Gb WAN options, dual drives for redundant Protect storage, and true dual power supplies.

2023-05-02 · open the original ↗

• A Raspberry Pi PBX and an ATA give hotline dialing cheaply. For a friend's art installation, the host runs Incredible PBX on a Raspberry Pi with an antique Model 40 phone on a Cisco SPA112 ATA. Lifting the Model 40's handset rings all three registered VoIP phones (including a Polycom VVX 410 and a Sangoma S300) at once, and lifting any of them dials the Model 40; the short closes with a pitch for Crosstalk's VoIP services.

2023-04-28 · open the original ↗

• The host rates the USW-Aggregation an overlooked, inexpensive 10 gig switch. At $269 it is a fanless layer 2 switch with eight 10 Gbps SFP+ ports (160 Gbps total switching capacity), 4.7 inches deep and drawing 30 W maximum; 10 gig Ethernet transceivers can wire in up to four 10GbE devices. He pitches it for uplinks to other switches or 10 gig devices.

2023-04-25 · open the original ↗

• The real fault was a second DHCP server on his secure LAN. Swapping his core US-24-PoE for a USW-Enterprise-24-PoE (12 × 1 GbE, 12 × 2.5 GbE, two 10G SFP+, locking power and an RPS port), the host plugged his Comcast Business gateway's 10.1.10.x network into a port without setting its isolated untagged VLAN. Devices took addresses from whichever server answered first, so cameras landed on 10.1.10.x and dropped out of UniFi Protect.
• Pre-November 2020 UNVRs fail when their internal USB boot drive wears out. Units with a back-panel date code of 2048 or earlier are affected and stop booting with a fast-flashing white LED; newer units have no flash drive. Ubiquiti has extended their warranty by two years, and UniFi OS for NVRs 3.1.7, in Early Access at recording, copies the boot data to an installed hard drive (at least one required).
• Swapping the glued-in flash drive did revive his failed UNVR. The host replaced it with a slim Kingston 32 GB USB 3 drive, after pulling and labelling the hard drives in order so the RAID would not need rebuilding, then restored a cloud backup. The fix only looked like a failure because of the concurrent DHCP problem; a later factory reset with drives left in wiped all his past footage.
• The UNVR's static-IP screen orders fields gateway first, inviting mistakes. It asks for gateway, then IP, then subnet mask; in haste the host swapped gateway and IP, making the UNVR unreachable and duplicating the gateway address on the network. He calls this his own fault but also an odd interface choice by Ubiquiti.
• Make one change at a time and chase every unexplained symptom. The host's lesson is to let each change settle before the next, and that "if something isn't working there's always a reason"; he credits Ubiquiti with handling the UNVR flaw well through the hardware change, warranty extension and software fix.

2023-04-14 · open the original ↗

• Put Home Assistant and all IoT devices on an isolated VLAN. The host argues IoT devices phone home to unknown cloud services and are attractive hacking targets, so the IoT network should have internet access only, with secure networks able to see into it but not the reverse. He also recommends network-wide DNS filtering such as Pi-hole or AdGuard Home to block malware, ads and data reporting.
• A Raspberry Pi works, but he distrusts its microSD card long-term. He ran Home Assistant on a Pi for over two years; installation uses Raspberry Pi Imager's built-in Home Assistant image (Pi 4, Pi 3, or CM4/Home Assistant Yellow options) onto a class 10 or better card, 32 GB being plenty. The web interface is at the device's IP on port 8123.
• The host runs his own instance as a VM on a Synology NAS. RAID 5 storage removes the SD-card risk and weekly snapshots allow rollback, though he stresses snapshots are not backups. He uses the VirtualBox VDI image with the recommended minimum of two CPUs, 2 GB RAM and 32 GB disk, switches legacy BIOS to UEFI, and gives the VM the NAS's second NIC, cabled to an untagged IoT-VLAN port.
• Docker is easiest but broke device discovery on his dual-homed NAS. He pulls the official image's "stable" tag (about 2 GB), mounts a NAS folder at /config, sets a TZ variable and uses host networking. With the NAS on both secure LAN and IoT VLAN, the GUI answers on both but discovery only happened on the secure LAN, so he does not use Docker himself.
• Automations are built from triggers, optional conditions and actions. His example turns the Lutron outdoor lights on at sunset (an offset like -01:00:00 fires an hour earlier) and a duplicated second automation turns them off at 10:30 pm. Devices found in the IoT network appear under notifications; Lutron and Philips Hue pairing requires pressing the bridge's physical button.

2023-04-05 · open the original ↗

• PDX LAN detects torrenting from a mirrored port feeding Suricata. A 10 Gbps fiber connection enters a MikroTik CCR1072, fiber-linked to a Cisco Nexus 5020 whose uplink port is mirrored to a 2U server. Suricata on it inspects all internet-bound traffic and logs events to syslog, which PacketFence, an open-source network access control system, monitors.
• PacketFence holds each attendee in VLANs tied to MAC and switch port. New machines land in a detection VLAN with a captive portal of event rules (no hacking, no BitTorrent, no illegal downloads); accepting moves them to the authorized main VLAN, with PacketFence knowing their MAC address and switch port.
• Any peer-to-peer transfer, legal or not, sends a user to torrent jail. The host tested it with a Fedora torrent and lost connectivity almost immediately, landing on a quarantine portal; after stopping the torrent, access returned in roughly the 30 seconds the admins quoted. Per the admins, a third offence locks the user out until they see the network staff.
• The jail dates from a 2011 abuse of the event's bandwidth. The host relays that with a then-large 1 Gbps connection, an attendee downloaded a whole TV season, and since the event centre's connection receives the infringement letters, the admins built the block.

2023-03-25 · open the original ↗

• The Dream Wall is a wall-mounted all-in-one UniFi OS console. It lists at $999 US and was in stock as of recording; the host's Early Access unit cost $799 in May 2022, and newer hardware replaces its 1.3-inch touchscreen with a 4.7-inch one. It carries a firewall, a 4x4 MIMO Wi-Fi 6 access point, four 802.3af, four 802.3at and four 802.3bt PoE ports, four non-PoE ports, a 10G SFP+ cage, plus a 2.5GbE WAN and a 10G SFP WAN.
• Its redundant power supplies share a single power cord. The host notes that true dual power, as in VoIP and PBX setups, needs a separate cord per supply so each can run to a different circuit in a data centre.
• The host finds the split cabling layout an odd design choice. Power and WAN enter through a channel at the bottom while the switch ports exit the top about an inch off the wall, with nowhere tidy to go; he notes the marketing photos never show top cables. Ports 16/17 or 19/20 can be set as WAN in UniFi, so all connectivity could come in from the top.
• Setup was quick, but the unit runs hot even idle. Mounting the roughly 20-pound unit took about 10 minutes (one side in a stud), adoption a minute, and updates about 20 minutes. The fan was whisper quiet at about 40%, yet the display read 149°F and his thermometer measured up to 120°F on the front, with no PoE load or traffic.
• The host will not recommend the Dream Wall to his customers. At $999 it adds little over the UDM SE beyond the top switch ports and redundant power; he would rather see the same components in a 2U rack-mount box with rear PSUs, a 16- or 24-port switch and room for redundant drives.

2023-03-21 · open the original ↗

• Switching to a privacy-focused browser is the easiest, biggest gain. The host, citing privacytest.org, recommends Brave or Firefox for blocking trackers and randomizing fingerprints; Brave is a drop-in Chrome replacement with the same extensions, and he uses DuckDuckGo on his iPhone. Stuck-on-Chrome users can add EFF's Privacy Badger or uBlock Origin; private windows are not anonymous, and Brave itself says to use the Tor Browser when personal safety depends on it.
• A privacy-focused search engine stops searches being tied to you. Google and Bing profit from targeted ads, so the host recommends Brave Search or DuckDuckGo as the browser's default search engine.
• Enable DNS over HTTPS, which browsers usually leave off. Even with HTTPS sites, plain DNS queries can be seen by anyone watching the traffic; in Brave or Chrome the "use secure DNS" setting under privacy and security turns it on with a chosen provider.
• The host calls a paid VPN a must, despite its rough edges. It masks the WAN IP and location, but Hulu, Disney+ and Netflix block known VPN IPs and it can break captive portals. He still uses Private Internet Access but stopped promoting it after Kape Technologies, which he calls an adware and malware company, bought it; he suggests Mullvad or Proton, saying he is not affiliated and the video is not sponsored.
• Network-wide DNS filtering covers devices you cannot configure. Cloudflare's 1.1.1.2 and 1.1.1.3, Quad9 and OpenDNS FamilyShield filter by a big company's rules, so the host prefers self-hosted Pi-hole or AdGuard Home. His main Pi-hole blocks over 50% of DNS requests on his network, with Roku devices phoning home tens of thousands of times a day.

2023-03-04 · open the original ↗

• The WiFiMan Wizard adds spectrum scanning iOS does not allow natively. It is a $99 Bluetooth accessory, now out of Early Access, that reads 2.4 and 5 GHz networks through the WiFiMan app (iOS 0.18.0+ or Android 1.15.0+); Ubiquiti claims about 240 minutes of continuous scanning on battery, which the host did not test.
• The scan view is basic and cannot be sorted. It lists SSIDs, channels, signal strength and a Wi-Fi 6 marker (his T-Mobile Home Internet showed channels 9 and 108 at -32 dBm), but the host wants sorting by signal or name and says scanning is all the device does.
• The host says home users should skip it; professionals might not. A home user is better served by an Android phone and its spectrum apps, while a wireless installer gains a compact tool-bag item. Even so, he prefers NetSpot for floor-plan coverage maps, since WiFiMan's maps cannot be saved and ignore multiple floors.

2023-03-03 · open the original ↗

• Cloudflare Tunnel gives remote access without opening firewall ports. A connector inside the LAN dials out to Cloudflare, so the WAN IP is never exposed, it works behind CGNAT such as Starlink and T-Mobile Home Internet, and the free plan covers everything shown. The host predicts this will put a real dent in VPN use over the next few years without ever fully replacing it.
• Cloudflare must manage the domain's DNS before a tunnel works. Beyond a free Cloudflare account, you need a domain whose root nameservers are moved to Cloudflare's; the host used Namecheap, for which he gives a link. Propagation can take five minutes to 24 hours, and his activation email arrived in about 10 minutes.
• The host recommends running the connector in Docker. A full Ubuntu VM worked but wasted CPU and RAM, and a Raspberry Pi forces command-line configuration, whereas Docker is set-and-forget with everything managed in the Zero Trust dashboard. On Synology, use the host network, enable auto-restart and trim Cloudflare's command to "tunnel run --token…", since no-autoupdate is already supplied; a constantly restarting container means that string was edited wrong.
• Each public hostname turns an internal service into valid HTTPS. His Synology NAS on HTTP port 5000 came out on port 443 with a valid certificate. Pitfalls: Pi-hole needs /admin on the URL, an HTTPS origin like his EdgeRouter 4 needs "No TLS Verify" turned on, and Docker services need their mapped port (49158 for OpenSpeedTest).
• Until Cloudflare Access is configured, anyone with the hostname gets in. The host adds a one-time-PIN login method and a wildcard self-hosted application whose policy includes specific emails or a domain, requires a US origin (which he notes a VPN easily bypasses) and can exclude countries or IP ranges. Services with their own login then require two separate authentications.

2023-02-21 · open the original ↗

• Apple IDs can now be secured natively with FIDO security keys. Apple added support with iOS 16.3 for iPhone and iPad and macOS Ventura 13.2, so YubiKeys now work directly; the host demonstrates on a YubiKey 5 NFC (USB-A or USB-C plus NFC) and a YubiKey 5Ci (USB-C and Lightning, no NFC).
• FIDO U2F is the strongest two-factor tier, above TOTP and SMS. The host ranks SMS lowest because phones are lost, stolen or SIM-swapped and the codes get phished; TOTP apps such as Google Authenticator or Authy are better, and TOTP held on a YubiKey better still; FIDO U2F has no code to phish and requires the physical key.
• The host prefers YubiKey 5 series keys because they do both. They handle FIDO U2F where a site supports it and TOTP, through the Yubico Authenticator app, where it does not. He says he has used them for about three years; the video carries affiliate links but is not sponsored or paid for by Yubico.
• Apple requires at least two keys, and setup takes minutes. The path is Settings, your name, Password & Security, Add Security Keys; an NFC key is held to the back of the phone, a Lightning key plugged in and its contact touched, and each is named. The host registers three keys and suggests keeping social-media apps on a separate phone with no personal data.

2023-02-14 · open the original ↗

• T-Mobile Home Internet is cheap, contract-free and easy to start. It cost the host $50 a month ($25 for existing T-Mobile phone customers), with a $100 sign-up rebate, and he walked out of a store with the modem in 30 minutes. He says he has no affiliation with T-Mobile and pays for the service himself; it needs solid local 5G coverage.
• The modem double-NATs and offers no bridge mode or static IP. Plugged into a UniFi UDM Pro's WAN it handed out a private 192.168.x address, and the host found no static-IP option on either the home or small-business service. The UDM Pro at first negotiated at 100 Mbps instead of 1 Gbps, which cleared after swapping the modem's two gigabit ports and rebooting.
• Measured speeds were high and fairly consistent over a month. A wired Raspberry Pi running a speed-test CLI client every 30 minutes, graphed in Grafana, showed up to about 600 Mbps at night and 250–300 Mbps by day; an iPhone 14 on the modem's Wi-Fi 6 regularly saw about 350 Mbps daytime.
• Occasional sluggish spells make it unfit as a business primary. About half a dozen times in a month browsing stalled for a couple of minutes, sending the host back to his Comcast Business 600x40 line at almost $350 a month. He judges double NAT bad for VoIP and other real-time services, and a missing static IP a problem where a business WAN IP cannot be dynamic.
• The host rates it fine for ordinary homes and ideal as backup. For basic browsing and streaming he calls it totally usable, and faster and cheaper than his $110-a-month Starlink at 80–150 Mbps, though Starlink works remotely. He is keeping it as failover on a dual-WAN router, or to carry guest and non-critical traffic.

2023-01-24 · open the original ↗

• Pi-hole is the easiest project and the one he uses most. The host says it runs in under 30 minutes as a network-wide ad blocker and DNS server; his dashboard shows it blocking over 30% of outbound queries, and he values it most on his IoT network against devices such as a Roku phoning home. He suggests pairing it with a filtering upstream DNS such as Cisco's FamilyShield for malware and adult content.
• PiVPN makes a home VPN server simple to stand up. It builds an OpenVPN or WireGuard server for remote access to home files and servers or to use the home connection while travelling, and generates QR codes to set up clients. The host runs it on his own home network and credits its maintainers with keeping it current and easy.
• OctoPrint is a must-have for anyone with a 3D printer. At its simplest it monitors prints and sends jobs over the network instead of by SD card; plugins add temperature monitors, touchscreen control and Octolapse time-lapses. The host has no tutorial of his own but says the OctoPi image flashes straight from the official Raspberry Pi Imager.
• Home Assistant is the deepest project and can automate almost anything networked. The open-source server auto-detects smart switches, bulbs, thermostats, vacuums and cameras; the host runs his office lighting from one Stream Deck button, his fish-tank lights and air pump, and his 3D printer's smart power strip on it. He has made no videos on it and points to dedicated channels.
• His newest build is a scheduled internet speed-test appliance graphed in Grafana. Built to test T-Mobile Home Internet, it layers the Ookla Speedtest CLI on Raspberry Pi OS, writes timestamped results to InfluxDB and graphs them in Grafana, and can be dropped into any network. He says the Grafana install can monitor other data too, and plans a video on it.

2023-01-20 · open the original ↗

• The scam email genuinely comes from PayPal, so authentication checks pass. The host's two emails came from [email protected] with SPF, DKIM and DMARC all passing, because the scammer sends a real invoice through PayPal's invoicing system; the "View and pay invoice" link and every other link point to real PayPal pages. He guesses the scammer knew from some past leak that he was a Coinbase customer.
• Logging into PayPal directly is the surest way to expose it. The email claimed a $479 USD payment to Coinbase and warned that cancellation after 48 hours would not be refunded; logging into the account without clicking any link shows no such transaction. The host reads the deadline as pressure to act.
• The scam pays out through a careless payer or a phone call. The host suspects it hopes someone, such as an accounting department paying invoices without scrutiny, simply pays it, or calls the "help desk" number, where scammers try to take over the caller's computer. He urges sharing the warning with anyone who pays PayPal invoices.
• The phone numbers were the weakest tell, and both were already dead. One email gave an 888 toll-free number and the other a 213 Los Angeles number, odd for a Silicon Valley company but easy to miss. Calling both from a fresh VoIP number a day after receiving them, the host was hung up on immediately; he infers scammers rotate numbers once one is flagged.

2023-01-10 · open the original ↗

• The Orange Pi 5 is a powerful Raspberry Pi alternative you can actually buy. It has a Rockchip 8-core 64-bit CPU, 4, 8, 16 or 32 GB of RAM, a Mali-G610 GPU rated for 8K at 60 fps, gigabit Ethernet, full-size HDMI and an M.2 slot. The host doubts most buyers need 32 GB on a single-board computer, and would move to an Intel NUC at that point.
• Its onboard M.2 slot forces a choice between storage and wireless. There is no built-in Wi-Fi or Bluetooth, so adding them means using the M.2 slot for a combo card instead of an NVMe SSD; the Raspberry Pi 4 also keeps dual HDMI. The host found documentation and community answers scarce: the official Orange Pi OS folder was empty, and Armbian added a page only weeks after he got the board.
• Booting from NVMe works by flashing the bootloader to SPI flash. He boots Orange Pi's Ubuntu 22.04 desktop image from microSD, copies the image over by SCP, installs the bootloader to the 16 MB SPI flash through orangepi-config (System, Install, option 7), then writes the image to the NVMe with dd. Default login is root with password "orangepi"; he says the same process worked for Armbian.
• A reused SPI flash or microSD card will defeat the M.2 boot. SPI flash that already holds partitions throws a no-space error until they are deleted with gdisk, as must old partitions on the NVMe. The microSD's data volume shares the SSD's UUID and takes precedence if reinserted, so it needs a randomized UUID. The NVMe install is a fresh system with a new DHCP address and settings.
• The NVMe SSD benchmarked about ten times faster than microSD. On pibenchmarks.com his Kioxia 128 GB NVMe scored 19,924, about sixth among the site's fastest SSD averages (top: 24,307), against roughly 2,000 for SD cards. Cold boot from the SSD took about 10 seconds; the drive cost under $20 on Amazon, and the M.2 needed hot glue for lack of a fitting screw.

2022-12-23 · open the original ↗

• The attacker took LastPass's backup copies of customer vault data. As reported, a breach in August yielded source code and technical data, which the hacker used to compromise an employee and obtain credentials and keys for a cloud backup storage service, separate from LastPass's main network, holding backups of company and user data.
• Stored passwords are encrypted, but weak master passwords can be cracked. LastPass says vault usernames, passwords, secure notes and form-fill data are AES-256 encrypted and need the master password, which it never knows; website URLs were unencrypted. The host warns weak master passwords could be brute-forced, expects phishing aimed at master passwords, and tells viewers not to believe LastPass's claim that strong ones face no danger.
• Changing the master password alone does not protect stored accounts. The host says to set a strong master password or passphrase and enable two-factor authentication, but then to change every password in the vault, most sensitive first (email, banking, cryptocurrency), and turn on two-factor authentication on each site wherever possible.
• The host's view is that users should reconsider LastPass altogether. He calls the breach entirely unacceptable for a company holding that level of responsibility over secure data, and asks viewers for alternatives rather than naming one.

2022-12-21 · open the original ↗

• Wi-Fi 6 improves crowded networks, not single-device speed or range. The host calls per-device speed gains the big misconception about 802.11ax: a fully Wi-Fi 6 device with a decent antenna may gain a little, but the standard's features squeeze more total throughput from the airwaves as device count rises. It uses both 2.4 GHz and 5 GHz; Wi-Fi 6E adds the newly opened 6 GHz band.
• Several features add capacity by sharing the channel more efficiently. Multi-user MIMO goes from 4x4 in Wi-Fi 5 to 8x8; OFDMA splits bandwidth into subcarriers so devices transmit simultaneously with variable-size packets; QAM rises from 256 to 1024 symbols. A new 160 MHz channel width raises data rates but is more interference-prone, so the host says to measure the local spectrum before choosing it.
• Other features cut interference and save client battery. BSS colouring lets nearby access points share a channel unless they share a colour; enhanced beamforming targets individual devices more precisely, raising beams from four to eight; target wait time and the uplink resource scheduler tell devices when to transmit and sleep, which matters most for phones and IoT devices.
• The host says most existing Wi-Fi 5 networks need not upgrade. Home users rarely have the density to notice, and he runs a mix of Wi-Fi 5 and 6 access points himself without issue; a business with around a hundred devices sees little benefit either. Event centres, theatres, churches and stadiums with hundreds of people do benefit, and anyone buying new should buy Wi-Fi 6.
• The host expects the next standard to be years from wide use. He says vendors already tout "Wi-Fi 7" but it is not formally recognized, that the next version is expected to be "Wi-Fi 8", 802.11be, with no Wi-Fi Alliance timeline, and notes Wi-Fi 6 arrived in 2019 but access points took a year or two to spread. He credits OpenAI's ChatGPT with helping research the video.

2022-12-15 · open the original ↗

• A portable paid hotspot could earn thousands at a disconnected event. The idea came from a three-day festival with no service where one booth sold internet at $20 for 10 minutes. His explicitly made-up numbers for a 10,000-person, three-day event (1% a day buying a 4-hour plan, 0.5% a 24-hour plan) give just under $3,300. He notes Starlink's terms explicitly prohibit resale and says he will not resell his own; LTE SIMs need their terms checked too.
• The host recommends Starlink for RVs, with LTE or point-to-point as fallbacks. The RV service is portable, has no data caps and can be paused, at $135 a month for months used. Alternatives are an LTE router such as the Pepwave MAX BR1, which he calls one of "our most popular choices", with omni or directional antennas, or a line-of-sight link from a nearby neighbour's connection.
• The whole kit runs from one PoE switch on a battery. A UniFi USW Lite 8 PoE powers an EdgeRouter X (via an 802.3af-to-24 V passive PoE converter), a Cloud Key Gen2 Plus for Protect, a G3 Flex camera as a theft deterrent and a UAP AC Mesh, at about 25 W. Starlink adds about 50 W; an EcoFlow Delta 1300 ran everything just under eight hours, and he judges solar impractical, leaving a generator or venue power.
• UniFi's guest hotspot handles payment but its portal editor is unreliable. The EdgeRouter's WAN must be eth4 because eth0 takes PoE in; the guest VLAN 51 SSID uses a 10/5 Mbps profile, client isolation and Cisco FamilyShield DNS, which must be in the pre-authorization allow list. He set a 10-minute free trial, 4 hours for $5.99 and 24 hours for $9.95 through Stripe, and tested the cap. On UniFi Network 7.3.76, "apply changes" sometimes fails; Ubiquiti told him 7.4 will improve it.
• A UniFi Dream Router adds application-layer blocking at lower power. The EdgeRouter setup cannot block streaming or torrenting, which he fears could bring piracy notices on his connection. The UDR's traffic management blocks peer-to-peer and media streaming, its "family" content filter blocks VPN, explicit and malicious domains, and it draws about 8 W. Against it: forum reports of lock-ups, rare stock, and his advice to carry two.

2022-12-10 · open the original ↗

• Starlink draws most of the Network in a Box's power. The whole setup pulls about 70–75 W from an EcoFlow Delta, of which about 25 W is the boxed gear (USW Lite 8 PoE switch powering a Cloud Key Gen2, EdgeRouter X, a pole-mounted mesh access point and a camera) and the rest Starlink; the host estimates the battery keeps it online for about 10 to 12 hours.

2022-12-09 · open the original ↗

• A complete small network can run from one power cord. A USW Lite 8 PoE switch, drawing 24 to 26 W in total, powers a Cloud Key Gen2 Plus running Protect, a G3 Flex camera, a mesh access point, and an EdgeRouter X through an 802.3af-to-24 V passive PoE converter; only the WAN needs plugging in.

2022-12-06 · open the original ↗

• PDXLAN's temporary network is built on enterprise gear with headroom. A Comcast 10 Gbps fiber feeds a 72-core MikroTik CCR1072, which the host saw barely strained at sustained 3–5 Gbps and a peak around 7.5 Gbps. A core switch with a 40 Gbps uplink sends 1 Gbps to two 48-port switches per table row; public Wi-Fi runs separately on a UDM Pro SE with DPI and two U6 Mesh access points, with Grafana, PRTG and a Discord bot alerting staff to offline switches.
• A flat /16 for about 650 devices is oversized but harmless here. The admin told the host he chose it because it is easy. The host says a /22 would fit best, and that a /16's risks (oversized layer 2 tables, broadcast traffic swamping printers) appear only with tens of thousands of devices, which a four-day event with enterprise gear never approaches.
• Torrenting users are automatically quarantined until they agree to rules. Internet-bound traffic is port-mirrored to a 2U Suricata server doing layer 7 filtering; on detecting peer-to-peer traffic it moves the user to a VLAN with no internet and a captive portal of event rules, returning them once they stop and accept the terms.
• The torrent ban mainly protects the venue's internet connection. Beyond ticket terms and a possible, unlikely saturation of the 10 Gbps link, the host says the real concern is piracy: Comcast could send notices or disconnect the Clark County Event Center near Portland, Oregon, jeopardizing future events there. Legitimate torrent users are simply out of luck.
• 1 Gbps uplinks to table switches are deliberate, not a bottleneck. Each 1 Gbps link serves 24 attendees on an event with 10 Gbps total, so the host argues 10 Gbps links would add nothing, while the 1 Gbps cap limits how much bandwidth any one user or table can take from others.

2022-11-22 · open the original ↗

• The host runs Unbound locally instead of an upstream DNS provider. After installing pi-hole with Cloudflare as a temporary upstream, he installs Unbound (config at /etc/unbound/unbound.conf.d/pihole.conf) so it queries root DNS servers directly on 127.0.0.1 port 5335, then points pi-hole's upstream DNS at that custom resolver so no outside party logs the household's DNS lookups.
• He warns against stacking too many block lists, since over-blocking breaks browsing. The default install pulls Steven Black's unified list (~158,000 domains); he adds the top two lists from each category on the Firebog's "green" (well-maintained, low-breakage) tier, raising the total to about 221,000 blocked domains, roughly a 30% increase.
• A static IP must be set before running the pi-hole installer. It can be a router-side DHCP reservation or a manual edit to the pi's dhcpcd.conf; for networks with multiple subnets (he runs a LAN, guest, and IoT network), the DNS setting must also change from "only allow local requests" to "respond only on interface eth0" so pi-hole answers queries from other VLANs.
• Without a firewall rule, savvy users can bypass pi-hole entirely. A device can simply be pointed at another DNS server, such as 1.1.1.1, so the host recommends blocking outbound port 53 traffic to any address except the pi-hole's own IP, though he leaves the exact router configuration out of scope of the tutorial.

2022-11-21 · open the original ↗

• A Flipper Zero can clone an LED strip's remote control. The host uses the Sub-GHz "read" function to capture the remote's on and off buttons for the strip behind his server rack, saves them as "rack on" and "rack off", then replays each from the saved list with "emulate"; he says the same works for infrared-controlled LEDs.

2022-11-16 · open the original ↗

• U2F hardware keys are the strongest second factor against phishing. The host says U2F cuts the chance of being phished to "practically zero", while OTP apps such as Google Authenticator or Authy, though far better than nothing, can still be phished. SMS is the least secure option, yet Google's two-step setup offers the account's phone number by default, so choose "show more options", then "security key".
• Register several keys and name each one descriptively. The host registers three, two YubiKey 5 NFC and a YubiKey 5Ci (on a USB-C to USB-A adapter), each named for its skin, so a lost key can be removed from the account without guessing. He says any U2F-capable key works the same way, even a Flipper Zero.
• Keep the ten backup codes, and skip weaker fallback methods. Printed or downloaded and stored safely, the single-use codes still let you in if every key is lost. Adding an authenticator app, voice or text message as further second factors reintroduces phishable routes, so the host advises keeping the account as locked down as possible.
• NFC keys make phone sign-in a tap rather than a plug-in. On the host's iPhone, Gmail's two-step prompt was cleared by holding the YubiKey 5 NFC to the back of the phone. The 5Ci's Lightning connector would also work, but he found NFC more efficient.
• Google domain admins should require two-step verification, then go further. Requiring it beats password-only sign-in, the host says, and for the next level he points administrators to Google's Advanced Protection Program, which requires U2F.

2022-11-15 · open the original ↗

• A powered pole with a PtMP receiver suits a remote park corner. At the far end of an RV park, the host points to a pole carrying power, a light, a box he takes to be a PoE network switch, two cameras and a receiving antenna on top; he calls it not pretty but done right for covering an area far from everything else.

2022-11-10 · open the original ↗

• Official UniFi Access cards are far more capable than cheap NFC tags. Per the data sheet, the starter kit's 20 cards are ISO 14443 Type A MIFARE DESFire EV2 with 4 KB of memory, room for a unique ID plus a cryptographic key, and the "UniFi Access proprietary security protocol"; they cost $2–4 on Amazon. NTAG215 tags (as in Nintendo amiibo) hold 504 bytes, no room for keys, and cost 35–65 cents.
• UniFi Access accepts almost any NFC credential, cheap tags included. On his test setup the host enrolled and opened the door with an official card, a YubiKey and an NTAG215 tag, but warns that being able to use any NFC type does not make it advisable.
• A Flipper Zero clones an NTAG215 tag and opens the door. Reading the official card and the YubiKey gave an "unknown ISO tag" whose UID emulation did nothing; the NTAG215 was identified, emulated and granted access. The host's advice: never use cheap NFC tags for access control.
• The host argues Ubiquiti should reject insecure cards outright. He asks why Access cannot detect that a tag cannot run its security protocol and either block it or accept only official cards, as Ubiquiti already restricts UniFi Protect to its own cameras. He admits he does not understand the card technology well and asks viewers to explain.

2022-11-08 · open the original ↗

• The host expects businesses to need managed workplace EV charging. Over the next five to ten years he expects many more employees charging at work, which raises who pays, how per-employee use is tracked or capped, how outsiders are kept off, and how electric delivery fleets are managed. He thinks that makes a real market for a product like Ubiquiti's EV Station.
• EV Station's announced specs are in line with other smart chargers. It lists at $799 in Ubiquiti's Early Access store, and the host notes EA pricing is subject to change. From the announcement: an SAE J1772 connector (Teslas need an adapter), 50 A charging shown, making it Level 2, a 10.1-inch touchscreen, a 16.4 ft (5 m) cable and a NEMA 3R weatherproof rating.
• It is managed through UniFi Connect with three access modes. The screenshots show plug-and-charge (open to anyone, he assumes), authorized users only, and disabled. The host speculates a price-per-kWh field to bill employees could follow, and spots SSO logins (Amazon, Microsoft, GitHub) and a "UniFi Talk" button he guesses is a softphone in the Connect app.
• He likes the idea but wouldn't bet a parking lot on Ubiquiti. Given Ubiquiti's history of launching products and then abandoning them, he would not spend thousands or tens of thousands filling a lot with EV Stations on the gamble they are still supported in three to five years, and he thinks the company may be ahead of the curve.

2022-11-03 · open the original ↗

• ITDRC volunteers restore communications after disasters. An ITDRC leader describes the nonprofit as about 3,300 tech-sector volunteers, set up in 2008 after a government-sponsored post-9/11 effort never took off. About a month after Hurricane Ian it had opened about 130–135 sites in southwest Florida, moving from search-and-rescue support to shelters and community recovery, and had over 80 active US deployments.
• The Fort Myers Beach marina hotspot runs on solar, Starlink and CBRS. The trailer has four 300 W panels and batteries, Starlink as primary and a Meraki CBRS link from a high-rise point-to-multipoint antenna as backup. The open SSID is throttled to 5 Mbps down/5 up with layer-7 filtering against streaming and torrents. Its batteries had stopped charging and were below 10%; a volunteer pulled one battery and used a generator to reach about 50%.
• A community hub got Wi-Fi, 5G, a printer and VoIP. The Pine Island American Legion serves 500–800 meals a day, so ITDRC covered the parking lot and food area for a computer cafe (FEMA forms, email, photos) on a 5G modem. It replaced the flooded printer, added a Polycom VoIP phone, and left a card with a site ID for logging tickets with central control in Texas.
• The host calls Starlink a game changer for disaster response. It recurred at every site: a medical tent with Starlink and a Meraki MR86 (another group withdrew a second dish), and the Cajun Navy's base with extra SSIDs for other organizations. The setups break often: an access point lost power during nearby electrical work and needed a generator, and one site's equipment had vanished.
• ITDRC's mobile command truck combines cellular, satellite and radio interoperability. Mobile Technology Unit 4 has multi-carrier cellular, a 1.8 m VSAT dish as secondary, a 50-ft tower with Wi-Fi and cameras, and 20 roof antenna slots. It carries VHF, UHF, aircraft, marine, 700/800 MHz and 2 m radios, a gateway that cross-patches VHF to 800 MHz with phone patch, and a team awareness kit tracking staff and CRM-fed sites.

2022-11-02 · open the original ↗

• A saved Flipper Zero signal pops open other people's Tesla charge ports. The host sends a saved "Tesla" Sub-GHz signal in a Costco parking lot and opens the charge ports of two Model Ys, calling it a harmless but fun prank.

2022-10-21 · open the original ↗

• The router was chosen because it also records the cameras. Eagle Paragliding, a Santa Barbara school opening a remote southern Oregon property, needed coverage at a main house, a warehouse and a camping area; Starlink feeds a UDM Pro, picked by the client because it also runs UniFi Protect, fitted with a 4 TB Seagate SkyHawk drive. U6 Lite APs cover interiors, U6 Mesh APs the outdoors, alongside G4 Pro and G4 Bullet cameras.
• Point-to-point wireless bridges tie the three sites together. Two GigaBeam-to-GigaBeam links connect house, warehouse and camping area; the host likes them because the 60 GHz link (about 1.6 Gbps planned) has a 5 GHz fallback he expects to carry 300–400 Mbps in bad weather. On site the links read 82.5% link potential with 1.4 Gbps capacity, and 84.5% with 1.3 Gbps at 70.8 m; he stops at "rock solid" rather than tuning toward 100%.
• The larger switches were chosen for passive PoE, not port count. The GigaBeams need 24 V passive while the APs are 802.3af, and the US-8-150W does both; the warehouse unit ended up using seven of eight ports. The camping area's USW Lite 8 PoE does only 802.3af, so an INS-3AF-I-G converter powers its GigaBeam. Network is 192.168.64.x on DHCP, with the GigaBeams statically set at .10–.13.
• Speed tests came close to full Starlink speed everywhere. The host measured 221/13 Mbps at the main-house driveway, 68.7/11.9 at the warehouse, 80.6/5.52 at the camping area through both GigaBeam hops, and 62.3/8.06 about 50 yards from the camping AP. APs were left at defaults, to be fine-tuned remotely if problems appear; one U6 Mesh for a future building arrived too late and will be shipped.
• The host still recommends UPS units and Ethernet surge protectors. The area gets severe weather and lightning, and the sites had surge strips but no UPS; he wants grounded UPSs for backup and clean power, and grounded Ethernet surge protectors on every outdoor device, of which he brought only one. Crosstalk, which did the design and install, offers both as services.

2022-10-14 · open the original ↗

• The captions hold only song lyrics, no spoken content. The 27-second short's caption track is a few lines of a song ("There's a starman waiting in the sky…"); nothing about the 3D print or UniFi gear named in the title is said.

2022-10-06 · open the original ↗

• Regulators have begun expelling non-compliant carriers from phone networks. As reported in FCC tweets and an fcc.gov notice, its Robocall Response Team issued first-of-their-kind Enforcement Bureau orders to begin removing seven named voice service providers from the Robocall Mitigation Database unless they show compliance, including STIR/SHAKEN across their IP networks. Chairwoman Jessica Rosenworcel wrote that "fines alone aren't enough."
• Removal means every other carrier must drop that provider's traffic. The host reads it as carriers such as Verizon and Bandwidth.com getting lists of IP addresses to block outright, legitimate calls included, which he expects will effectively kill small telcos that profited from terminating robocalls. He calls it the strongest enforcement he has seen.
• The host shut his own SIP business rather than comply. He says call-termination infrastructure, identity certificates and digitally signing every call had too steep a learning curve for the revenue, and many other small carriers left too. He still welcomes the crackdown because so many robocalls are scams; he points to his earlier STIR/SHAKEN video with Tony Lewis, CEO of ClearlyIP.

2022-10-04 · open the original ↗

• The shrunken version 2 slightly outperforms the original in testing. The host concludes TP-Link, with the EAP610 v2, significantly shrank the Wi-Fi 6 access point while improving speeds a little, answering the common complaint that its APs are too large. He doesn't know whether v1 will be end-of-lifed and wants the same treatment for TP-Link's more powerful APs.
• The new model is cheap, compact and flexibly powered. It lists at $99.99 MSRP, is just over 6 inches across and 1.3 inches tall, with a 4 dBi 2.4 GHz antenna rated up to 574 Mbps and a 5 dBi 5 GHz antenna up to 1.2 Gbps. It runs on 802.3at PoE, 48 V passive PoE or an included 12 V 1.4 A DC adapter, and is managed by an Omada controller (hardware OC200, software or cloud).
• Averaged runs from three devices all favoured v2 slightly. The host ran five tests per device (his PC, an iPhone 13, an iPad) against an OpenSpeedTest server on Ubuntu 22.04, through a TP-Link TL-SG2210MP switch and TL-R605 router, with identical positioning. He flags that the server's gigabit NIC may have capped results, and that the iPad's uploads ran about half its downloads on both APs.
• Five-minute sustained stress tests showed the two essentially tied. Run twice per AP from the PC only, v2 led on download by what the host eyeballed as roughly 10 (units unstated) and trailed slightly on upload, which he called splitting hairs.

2022-10-03 · open the original ↗

• The host's bench test link delivered near-gigabit throughput. The host bridged two GigaBeams across his office, each powered from a US-8-150W switch port set to 24 V passive PoE, with one side feeding a UDM Pro and an OpenSpeedTest server on a Shuttle PC. He measured roughly 712 Mbps down and 941 Mbps up from a wired laptop across the link.

2022-09-22 · open the original ↗

• At Best Buy, the host would pick Netgear's cheaper Wi-Fi 6 router. Skipping the whole-home mesh kits and anything branded "gaming", he narrows it to two Netgear models with near-identical specs, the AX2400 Nighthawk at $179 and the AX1800 at $139, and buys the AX1800. He passes over a $500 Nighthawk with a 2.5 Gbps Ethernet port, and a Linksys Wi-Fi 6 router at $149 that he says matches another model costing twice as much.

2022-09-20 · open the original ↗

• Crosstalk is posting exclusive content on Facebook, not YouTube. The first one, "My G4 Doorbell Pro broke", goes through the host's troubleshooting steps for getting a UniFi G4 Doorbell Pro back online, and is only on facebook.com/crosstalksolutions. The host adds that the channel is now on Instagram and TikTok too.

2022-09-17 · open the original ↗

• The host treats the Uber breach as a complete compromise. He advises changing an Uber password now to be safe. The New York Times broke the story first, after the attacker contacted it with images of Uber's internal email, cloud and code repositories.
• The attacker got in through social engineering and a hard-coded credential. As reported, an 18-year-old who did it "just for fun" social-engineered an employee, logged in over VPN, and scanned the intranet. On a network share he found PowerShell scripts, one with an admin username and password in it, and used those to take over nearly everything. He then announced the breach on Uber's internal Slack, and staff at first took it for a joke.

2022-09-13 · open the original ↗

• STIR/SHAKEN made Crosstalk close its own SIP-trunking business. Crosstalk SIP ran for about three years and served 60–70 customers, peaking at 130,000–140,000 calls a month. It resold wholesale minutes from VoIP Innovations, which Sangoma later bought, at a 15–20% margin after billing, tax and staff costs. All customers have now been moved to other providers.
• Attestation grades how far a carrier vouches for a caller. Calls are signed with a digital certificate at a session border controller (SBC). Level A means the carrier knows the caller and that they own the number, B means it knows the caller but not the number (for example Follow Me forwarding), and C is a gateway call with neither verified, which is the grade most likely flagged as spam. The host cites Bandwidth.com: 3–5 billion robocalls a month, about 40% thought to be fraud.
• Compliance costs a small reseller more than its margin can carry. According to ClearlyIP CEO Tony Lewis, a carrier needs a token from iconectiv, priced as a share of its FCC 499 filing revenue with a minimum of a few thousand dollars a year. It then needs a certificate costing thousands a year, a sandbox test suite, and geographically redundant SBCs that handle 911. Lewis calls the cheaper option, call-forking signing services that need a PJSIP patch, convoluted.
• The host's advisers wrongly told him a reseller was covered. Both VoIP Innovations and a telecom lawyer said its compliance covered him. Around June–July the FCC clarified that whoever bills the end user is the originating provider and must sign the calls. The exemption for providers under 100,000 subscribers ended July 1, and the FCC legal department sent warning letters to firms claiming compliance without a certificate. Lewis says Inteliquent will now sign uncertified customers' calls only at C.
• Lewis and the host doubt the system stops robocalls yet. Lewis reports that T-Mobile users see "likely spam" and nine in ten test calls arrive at C, partly because SS7 legs strip SIP headers. The host predicts the large carriers will lobby their way past enforcement while robocallers work around the rules. Disclosure: the two co-run a paid open-source PBX training course.

2022-09-07 · open the original ↗

• Map the walls before placing any access point. The host traces the floor plan in the UniFi Design Center (design.ui.com), marking exterior walls, interior walls and window or door openings. Exterior walls weaken signal more because of stucco or siding, so knowing which walls are exterior matters; he had to guess for the garage and closet walls.
• Two U6 Lites cover a 1,575 sq ft house. The host puts the $99 access points in two spots. One goes in the dining room near the back window, to reach the patio and master bedroom. The other goes just outside the opening between bedrooms 2 and 3 rather than inside their hallway, which keeps the foyer and garage in range. His target is light blue coverage everywhere at 2.4 GHz, with about –60 dBm (green) at worst.
• Too much overlap makes phones flip-flop between access points. iPhones are especially aggressive about jumping to the strongest one. The host's fix is to keep the strongest zones barely touching and to lower output power on the dining-room access point, which serves an open space with few obstructions. He calls tuning more art than science: test and adjust.
• 5 GHz leaves weak spots that 2.4 GHz covers. On 5 GHz the far bedroom and the garage are weaker, but most devices drop to 2.4 GHz and keep working. If the garage needs strong Wi-Fi, the host suggests adding an access point there at low power so it covers only the garage.
• Design Center plans transfer to other brands' access points. The host says the results hold for any brand whose signal strength is similar to the Ubiquiti model placed in the plan.

2022-09-01 · open the original ↗

• The USP-PDU-Pro is a UniFi-managed 2U rack power strip. Its MSRP is $279. It has 16 outlets rated 125 V AC and 15 A, 1,875 W in total: 12 across the top, plus 4 spaced out along the bottom for large power bricks. It also has 4 USB-C ports (2 A per port, 20 W shared), a circuit breaker, and a 1.3-inch touchscreen. The host has run it in his test rack since February, through Early Access.
• Its redundant-WAN ports did nothing in the host's software. Besides a Fast Ethernet management port, it has three gigabit ports for splitting one ISP link across two Dream Machine Pros, the guide's "type B" install. On UniFi OS 1.12.24 and Network 7.2.93, those ports did not appear in UniFi and showed no activity, though traffic did pass through to his UDM Pro. The host expects UniFi to support redundant firewalls eventually but cannot say when.
• Each outlet can be named, switched, metered and power-cycled from UniFi. The host keeps his loud rack fans set to disabled, so they shut off once the PDU connects. A "modem power cycle" option reboots the outlet labelled as the ISP modem when the UDM Pro detects an internet outage. At recording, his rack drew about 91 W.
• The host wants outlet schedules and rates the price as fair. He would like time groups for switching outlets on and off on a schedule. He judges $279 reasonable against 1U and 2U rack PDUs from CyberPower and APC, and asks viewers for an equally capable competitor at that price.

2022-08-31 · open the original ↗

• Krebs has retracted his Ubiquiti breach reporting and apologized. His post "Final thoughts on Ubiquiti" says his sole source, since federally indicted for allegedly giving false information to the press, is no longer credible and that the articles are removed. The host, saying he has not followed the lawsuit, speculates that the terse wording reads like the product of a settlement.
• The original report cost Ubiquiti about a quarter of its share price. Krebs's anonymous-source story came out in April 2021, about the breach the host dates to around December 2020; he shows the stock falling from about $389 on March 26 to about $289 on April 1. It sat near $311 at recording, which he puts down mostly to the market, chip shortages and supply-chain problems.
• The "whistleblower" turned out to be the hacker himself. By December 2021 it emerged that the Ubiquiti security employee feeding Krebs had done the breach, then leaked it posing as an insider when Ubiquiti did not pay a ransom the host recalls as about 60 bitcoin. The host says Krebs had no way to know.
• The host guesses the settlement bought an apology, not damages. Ubiquiti sued Krebs around April 2022. The host reasons that a blogger could never cover the roughly $4 billion of market capitalisation lost, so the suit may have aimed at the concession and deletion, perhaps with legal fees; he stresses this is speculation.
• He blames only the hacker, neither Krebs nor Ubiquiti. In his reading Krebs acted reasonably on a vetted source and had reason to protect it, while Ubiquiti acted in its own interest in not disclosing the breach and then suing. He leaves open how sure a journalist must be before publishing damaging claims.

2022-08-25 · open the original ↗

• A free equipment-list request became a public design video instead. A Tennessee lodge owner wanted Ubiquiti gear for a four-acre property: 16 cabins 20–30 feet apart, a main building 200–500 feet away, and no trenching allowed. The host says Crosstalk sells design and installation, not Ubiquiti hardware, because there is "zero margin" in it.
• The main building is designed for redundancy because guests expect uptime. Two Netgate 4100 Base firewalls ($599 each, the first Netgate model to support high availability) with dual WAN, so Starlink could back up the line, plus optional TAC Pro support. Inside go three U6 Pro APs at $149 and a Cloud Key Gen2 Plus, chosen because the Gen2 was out of stock.
• Two PoE switches were chosen so either can carry the full load. The host specifies two Switch Lite 16 PoE at $199, eight PoE+ ports each, over two cheaper Switch Lite 8 PoE. Those have only four PoE ports against five PoE devices, so losing one would mean dropping an AP or adding an injector.
• One sector AP reaches all the cabins over clear line of sight. A LiteAP GPS ($99) on the building's north corner feeds NanoBeam 5AC Gen2 stations, about 300 Mbps per link in Ubiquiti's design tool at 40 MHz width. It needs an INS-3AF-I injector, since it runs 24 V passive PoE and the switch only provides 802.3af, plus surge protectors on outdoor units.
• The host rejects the client's AP-in-every-cabin plan as overkill. Instead he puts a Mesh Pro AP ($199) outside about every third building, six satellite sites at almost $2,000 total. Each chains two PoE injectors from the NanoBeam; adding a Switch Lite 8 PoE per site would cost about $774 more across six.
• Crosstalk would bill this as a two-day, two-person install. Main-building equipment comes to about $3,383 before cabling. The host prices labor at about $6,200: four hours of design at $200 an hour, a two-day minimum on site at $1,800 a day including per diem (ideally with two staff), and two travel days at half rate ($900).

2022-08-24 · open the original ↗

• The U6 Enterprise's 6 GHz band buys capacity, not speed. The host explains that this first Wi-Fi 6E AP from Ubiquiti gains less interference and room for 80 and 160 MHz channels in a band about four times the size. Ubiquiti rates it at 10.2 Gbps aggregate (4.8 Gbps on 6 GHz, 4.8 on 5 GHz, 570 Mbps on 2.4 GHz) and 600 clients, on a 2.5 GbE port with PoE+.
• Single-client tests landed around 200–400 Mbps. On a UDM Pro (UniFi OS 1.12.24, Network 7.2.91, the latest stable at recording), with the AP on a 2.5 GbE port of a USW Enterprise 24 PoE, the host's Wi-Fi 6 laptop and iPhone averaged about 350 Mbps down and 350–400 Mbps up to an OpenSpeedTest server on 10 GbE. iPerf gave 200–350 Mbps; he concedes this does not test a 600-client AP.
• A 20-laptop class contest still bottlenecked elsewhere. At the Crosstalk Fundamentals of Networking class in Austin, students raced to download a 2 GB file for a prize of a U6 Enterprise and UDM SE worth about $800. The Windows 11 SMB share on the host's laptop was the weak link, and the winner took about 8 minutes; the AP "didn't break a sweat".
• Wi-Fi 6 access points are hard to load-test without real money. The host had considered a dozen Raspberry Pis running a random-browsing script but notes they are not Wi-Fi 6. He has no cheap capacity test and asks viewers for one.

2022-08-17 · open the original ↗

• Crosstalk is replacing Yealink with Snom over security concerns. The host, whose firm sells and supports VoIP systems, says Yealink looks headed for the same bucket as Huawei and Hikvision. Crosstalk evaluated several brands and is now selling Snom for its conference and DECT phones, alongside its own Crosstalk-branded desk phones.
• The C520 adds detachable wireless mics for long tables. It lists at $345 MSRP: a full-duplex speakerphone for small to mid-size rooms, with two mics rated 70 hours standby and 12 hours talk that recharge on the base. It also has PoE or a power adapter, G.722, Bluetooth pairing to a cell phone, automatic gain control, a 2-year warranty, and expansion via C52 SP speakers.
• The C620 costs more for a fully wireless phone. At $499 it keeps the wireless mics but drops Bluetooth; the phone itself lifts off a charging base and talks to a separate DECT base, with 12 hours of talk time. The host pitches it for tables with no PoE or power beneath, and it carries a 3-year warranty.
• The host's test call on the C520 sounded clear. He called Crosstalk's main line and judged the quality "really good", noting the call went over his cellular connection rather than an HD voice codec.